Most recent entries from all

bdu:2026-10412

BELL-CVE-2026-40612

Affected: Alpaquita:23: jq, Alpaquita:25: jq, Alpaquita:stream: jq

EUVD-2026-310033

fkie_cve-2026-40612

jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since the JSON parser caps at depth 10000), the C stack is exhausted.

msrc_CVE-2026-40612 — jq: Stack overflow via unbounded recursion in jv_contains

msrc_CVE-2026-40612

OESA-2026-2424 — jq security update

Affected: openEuler:20.03-LTS-SP4: jq

jq is a lightweight and flexible command-line JSON processor. you can use it to slice and filter and map and transform structured data. It is written in portable C, and it has zero runtime dependencies. it can mangle the data format that you have into the one that you want. Security Fix(es):

jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.(CVE-2026-41256)

jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.(CVE-2026-41257)

jq is a command-line JSON processor. In 1.8.1 and earlier, when decN…

openSUSE-SU-2026:10850-1 — jq-1.8.1-3.1 on GA media

jq-1.8.1-3.1 on GA media

RHSA-2026:29986 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

jq: stack overflow via unbounded recursion in jv_contains jq: embedded NUL truncates top-level jq programs loaded with -f jq: signed-int overflow in stack_reallocate jq: jq: Arbitrary Code Execution or Denial of Service via Signed Integer Overflow jq: embedded NUL in jq import paths causes local redaction-policy bypass and preserves sensitive fields in published artifacts jq: stack overflow in recursive object merge jq: stack overflow in module loading on mutual include jq: jq: Denial of Service via deeply nested array comparison jq: jq: Heap out-of-bounds write via oversized raw file processing jq: jq: Denial of Service via integer overflow and buffer overrun on 32-bit systems

SUSE-SU-2026:22545-1 — Security update for jq

Security update for jq

UBUNTU-CVE-2026-40612

Affected: Ubuntu:Pro:14.04:LTS: jq, Ubuntu:Pro:16.04:LTS: jq, Ubuntu:Pro:18.04:LTS: jq, Ubuntu:Pro:20.04:LTS: jq, Ubuntu:22.04:LTS: jq, Ubuntu:24.04:LTS: jq, Ubuntu:25.10: jq, Ubuntu:26.04:LTS: jq

WID-SEC-W-2026-1469 — jq: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in jq ausnutzen, um einen Denial of Service Angriff durchzuführen, Daten zu manipulieren oder andere, nicht näher spezifizierte Auswirkungen zu erreichen.