diff --git a/contrib/patches/edirect-xml-bounds-check.patch b/contrib/patches/edirect-xml-bounds-check.patch
new file mode 100644
index 0000000..7e369ca
--- /dev/null
+++ b/contrib/patches/edirect-xml-bounds-check.patch
@@ -0,0 +1,36 @@
+--- a/eutils/xml.go 2026-01-08 20:01:51.000000000 +0000
++++ b/eutils/xml.go 2026-04-03 06:53:30.494928480 +0000
+@@ -1791,14 +1791,23 @@
+
+ // at start of end tag
+ idx++
++ if idx >= txtlen {
++ return NOTAG, NONE, "", "", idx
++ }
+ start = idx
+ ch = text[idx]
+ // expect legal first character of element
+ if inFirst[ch] {
+ idx++
++ if idx >= txtlen {
++ return NOTAG, NONE, "", "", idx
++ }
+ ch = text[idx]
+ for inElement[ch] {
+ idx++
++ if idx >= txtlen {
++ return NOTAG, NONE, "", "", idx
++ }
+ ch = text[idx]
+ }
+ str := text[start:idx]
+@@ -1806,6 +1815,9 @@
+ // skip past unexpected blanks
+ for inBlank[ch] {
+ idx++
++ if idx >= txtlen {
++ return NOTAG, NONE, "", "", idx
++ }
+ ch = text[idx]
+ }
+ if ch != '>' {
diff --git a/guix.scm b/guix.scm
index 9b0f382..43c3f77 100644
--- a/guix.scm
+++ b/guix.scm
@@ -141,7 +141,9 @@ GeneCup with four gene symbols (gria1, crhr1, drd2, and penk).")
(snippet
'(begin
(delete-file "Mozilla-CA.tar.gz")
- (delete-file "cacert.pem")))))
+ (delete-file "cacert.pem")))
+ (patches
+ (list (local-file "contrib/patches/edirect-xml-bounds-check.patch")))))
(build-system gnu-build-system)
(arguments
(list
|
