diff --git a/gnu/local.mk b/gnu/local.mk
index 1654fe729b..4592e4c38a 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1383,7 +1383,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/tcc-boot-0.9.27.patch			\
   %D%/packages/patches/tclxml-3.2-install.patch			\
   %D%/packages/patches/tcsh-fix-autotest.patch			\
-  %D%/packages/patches/tcsh-fix-out-of-bounds-read.patch	\
   %D%/packages/patches/teensy-loader-cli-help.patch		\
   %D%/packages/patches/teeworlds-use-latest-wavpack.patch	\
   %D%/packages/patches/texinfo-5-perl-compat.patch		\
diff --git a/gnu/packages/patches/tcsh-fix-autotest.patch b/gnu/packages/patches/tcsh-fix-autotest.patch
index 78444a1b2a..200867cb9b 100644
--- a/gnu/packages/patches/tcsh-fix-autotest.patch
+++ b/gnu/packages/patches/tcsh-fix-autotest.patch
@@ -63,38 +63,14 @@
  
  AT_DATA([comment2.csh],
  [[echo testing...@%:@\
-@@ -567,10 +567,10 @@ run=3
-# Adapt to changes in sed 4.3:
-# https://github.com/tcsh-org/tcsh/commit/2ad4fc1705893207598ed5cd21713ddf3f17bba0
- ]])
- AT_DATA([uniformity_test.csh],
- [[
--set SERVICE_NAME_LOG = `cat batchsystem.properties | grep '^jdbc_url' | sed -ne 's/^[^=]*=[^@]*@[:blank:]*\([^$]*\)$/\1/p' | perl -pe 's/\s//g'  |  perl -pe 's/\)/\\\)/g' | perl -pe 's/\(/\\\(/g'`
-+set SERVICE_NAME_LOG = `cat batchsystem.properties | grep '^jdbc_url' | sed -ne 's/^[^=]*=[^@]*@[[:blank:]]*\([^$]*\)$/\1/p' | perl -pe 's/\s//g'  |  perl -pe 's/\)/\\\)/g' | perl -pe 's/\(/\\\(/g'`
- echo -n "$SERVICE_NAME_LOG" > ./output1
- 
--cat batchsystem.properties | grep '^jdbc_url' | sed -ne 's/^[^=]*=[^@]*@[:blank:]*\([^$]*\)$/\1/p' | perl -pe 's/\s//g'  |  perl -pe 's/\)/\\\)/g' | perl -pe 's/\(/\\\(/g' > ./output2
-+cat batchsystem.properties | grep '^jdbc_url' | sed -ne 's/^[^=]*=[^@]*@[[:blank:]]*\([^$]*\)$/\1/p' | perl -pe 's/\s//g'  |  perl -pe 's/\)/\\\)/g' | perl -pe 's/\(/\\\(/g' > ./output2
- 
- diff -uprN ./output1 ./output2 >& /dev/null
- 
-@@ -587,7 +587,7 @@ AT_DATA([quoting_result_test.csh],
- echo "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP\)(HOST=db\)(PORT=1521\)\)(CONNECT_DATA=(SERVER=DEDICATED\)(SERVICE_NAME=bns03\)\)\)" > ./expected_result
- 
- set string = "jdbc_url=jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=db)(PORT=1521))(CONNECT_DATA=(SERVER=DEDICATED)(SERVICE_NAME=bns03)))"
--set SERVICE_NAME_LOG  = `echo "$string" | grep '^jdbc_url' | sed -ne 's/^[^=]*=[^@]*@[:blank:]*\([^$]*\)$/\1/p' | perl -pe 's/\)/\\\)/g'`
-+set SERVICE_NAME_LOG  = `echo "$string" | grep '^jdbc_url' | sed -ne 's/^[^=]*=[^@]*@[[:blank:]]*\([^$]*\)$/\1/p' | perl -pe 's/\)/\\\)/g'`
- 
- echo "$SERVICE_NAME_LOG" > ./actual_result
- 
 --- tests/subst.at
 +++ tests/subst.at
-@@ -54,7 +54,7 @@ AT_CHECK([echo 'echo ~; echo "$HOME"' | tcsh -f | uniq | wc -l | tr -d ' \t'],
+@@ -54,7 +54,7 @@ AT_CHECK([export HOME=$(getent passwd $(id -un) | awk -F: '{ print $(NF - 1) }')
  , [1
  ])
  
--AT_CHECK([echo "echo ~$(id -un)/foo; echo \"$HOME/foo\"" | tcsh -f | uniq dnl
-+AT_CHECK([echo "echo ~$(id -un)/foo; echo \"$HOME/foo\"" | tcsh -f | grep -v "/homeless-shelter" | uniq dnl
+-AT_CHECK([export HOME=$(getent passwd $(id -un) | awk -F: '{ print $(NF - 1) }'); echo "echo ~$(id -un)/foo; echo \"\$HOME/foo\"" | tcsh -f | uniq dnl
++AT_CHECK([export HOME=$(getent passwd $(id -un) | awk -F: '{ print $(NF - 1) }'); echo "echo ~$(id -un)//foo; echo \"\$HOME/foo\"" | tcsh -f | uniq dnl
  	  | wc -l | tr -d ' \t'], , [1
  ])
  
@@ -110,21 +86,6 @@
  ]])
  chmod a+x args.sh
  AT_CHECK([tcsh -f listflags.csh], ,
-@@ -704,9 +705,9 @@ AT_CHECK([tcsh -f mail.csh], ,
-# This test fails by trying to change to the build user's home
-# directory, which does not exist.
- AT_CLEANUP
- 
- 
--AT_SETUP([$ cdtohome])
--AT_CHECK([tcsh -f -c 'cd'], 0)
--AT_CLEANUP
-+#AT_SETUP([$ cdtohome])
-+#AT_CHECK([tcsh -f -c 'cd'], 0)
-+#AT_CLEANUP
- AT_SETUP([$ noimplicithome])
- AT_CHECK([tcsh -f -c 'unset cdtohome; cd'], 1, , [cd: Too few arguments.
- ])
 @@ -728,55 +729,57 @@ TCSH_UNTESTED([$ oid])
  AT_SETUP([$ owd])
  
diff --git a/gnu/packages/patches/tcsh-fix-out-of-bounds-read.patch b/gnu/packages/patches/tcsh-fix-out-of-bounds-read.patch
deleted file mode 100644
index 48c294f78e..0000000000
--- a/gnu/packages/patches/tcsh-fix-out-of-bounds-read.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-Fix out-of-bounds read in c_substitute():
-
-http://seclists.org/oss-sec/2016/q4/612
-
-Patch copied from upstream source repository:
-
-https://github.com/tcsh-org/tcsh/commit/6a542dc4fb2ba26518a47e9b3a9bcd6a91b94596
-
-From 6a542dc4fb2ba26518a47e9b3a9bcd6a91b94596 Mon Sep 17 00:00:00 2001
-From: christos <christos>
-Date: Fri, 2 Dec 2016 16:59:28 +0000
-Subject: [PATCH] Fix out of bounds read (Brooks Davis) (reproduce by starting
- tcsh and hitting tab at the prompt)
-
----
- ed.chared.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/ed.chared.c b/ed.chared.c
-index 1277e53..310393e 100644
---- ed.chared.c
-+++ ed.chared.c
-@@ -750,7 +750,7 @@ c_substitute(void)
-     /*
-      * If we found a history character, go expand it.
-      */
--    if (HIST != '\0' && *p == HIST)
-+    if (p >= InputBuf && HIST != '\0' && *p == HIST)
- 	nr_exp = c_excl(p);
-     else
-         nr_exp = 0;
diff --git a/gnu/packages/shells.scm b/gnu/packages/shells.scm
index 1fd138fb4c..ef7f911682 100644
--- a/gnu/packages/shells.scm
+++ b/gnu/packages/shells.scm
@@ -334,7 +334,7 @@ written by Paul Haahr and Byron Rakitzis.")
 (define-public tcsh
   (package
     (name "tcsh")
-    (version "6.20.00")
+    (version "6.22.02")
     (source (origin
               (method url-fetch)
               ;; Old tarballs are moved to old/.
@@ -344,9 +344,8 @@ written by Paul Haahr and Byron Rakitzis.")
                                         "old/tcsh-" version ".tar.gz")))
               (sha256
                (base32
-                "17ggxkkn5skl0v1x0j6hbv5l0sgnidfzwv16992sqkdm983fg7dq"))
-              (patches (search-patches "tcsh-fix-autotest.patch"
-                                       "tcsh-fix-out-of-bounds-read.patch"))
+                "0nw8prz1n0lmr82wnpyhrzmki630afn7p9cfgr3vl00vr9c72a7d"))
+              (patches (search-patches "tcsh-fix-autotest.patch"))
               (patch-flags '("-p0"))))
     (build-system gnu-build-system)
     (native-inputs