diff --git a/bootstrap.conf b/bootstrap.conf
index 7a464a289..7cd375ba9 100644
--- a/bootstrap.conf
+++ b/bootstrap.conf
@@ -84,7 +84,9 @@ bootstrap_post_import_hook () {
   # Instead of patching our gnulib and therefore maintaining a fork, submit
   # changes to gnulib and update the hash above when they've merged.  Do not
   # add new patches here.
-  for patchname in fix-width fix-regcomp-resource-leak; do
+  for patchname in fix-width \
+      fix-regcomp-resource-leak \
+      fix-regexec-resource-leak; do
     patch -d grub-core/lib/gnulib -p2 \
        < "grub-core/lib/gnulib-patches/$patchname.patch"
   done
diff --git a/conf/Makefile.extra-dist b/conf/Makefile.extra-dist
index 230a1d68f..f59b8d8b3 100644
--- a/conf/Makefile.extra-dist
+++ b/conf/Makefile.extra-dist
@@ -30,6 +30,7 @@ EXTRA_DIST += grub-core/genemuinitheader.sh
 
 EXTRA_DIST += grub-core/lib/gnulib-patches/fix-width.patch
 EXTRA_DIST += grub-core/lib/gnulib-patches/fix-regcomp-resource-leak.patch
+EXTRA_DIST += grub-core/lib/gnulib-patches/fix-regexec-resource-leak.patch
 
 EXTRA_DIST += grub-core/lib/libgcrypt
 EXTRA_DIST += grub-core/lib/libgcrypt-grub/mpi/generic
diff --git a/grub-core/lib/gnulib-patches/fix-regexec-resource-leak.patch b/grub-core/lib/gnulib-patches/fix-regexec-resource-leak.patch
new file mode 100644
index 000000000..f490e05fb
--- /dev/null
+++ b/grub-core/lib/gnulib-patches/fix-regexec-resource-leak.patch
@@ -0,0 +1,11 @@
+--- a/lib/regexec.c
++++ b/lib/regexec.c
+@@ -2270,7 +2270,7 @@ merge_state_with_log (reg_errcode_t *err, re_match_context_t *mctx,
+ 	 these destinations and the results of the transition table.  */
+       pstate = mctx->state_log[cur_idx];
+       log_nodes = pstate->entrance_nodes;
+-      if (next_state != NULL)
++      if (next_state != NULL && next_state->entrance_nodes != NULL)
+ 	{
+ 	  table_nodes = next_state->entrance_nodes;
+ 	  *err = re_node_set_init_union (&next_nodes, table_nodes,