CVE-2026-56289

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>patch</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>GNU patch is vulnerable to a denial of service (DoS) due to improper
	validation of hunk (single block of changes in diff) line offsets in
	unified-diff input. A specially crafted patch can specify an extremely
	large line number, causing the application to enter an effectively
	infinite processing loop while attempting to locate the requested
	position.
This results in excessive CPU consumption and prevents the
	process from completing.
An attacker can trigger this behavior by
	supplying a malicious patch file, causing the utility to become
	unresponsive and require manual termination.



This issue has been
	fixed in the commit faba04ef4f2b410257f76c1b9dc85e350929c4b9</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-56289</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-56289</url>
    </references>
    <dates>
      <discovery>2026-07-09</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>