jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:10585 advisory.

    * jq: jq has signed integer overflow in jv.c:jvp_array_write (CVE-2024-23337)
      * jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of jq installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-23337 advisory.

  - jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises     when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of     service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue. (CVE-2024-23337)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of jq installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-23337 advisory.

  - jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises     when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of     service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue. (CVE-2024-23337)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-10618 advisory.

    - Fix CVE-2025-48060 AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt)
    - Fix CVE-2024-23337 jq has signed integer overflow in jv.c:jvp_array_write

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:10618 advisory.

    * jq: jq has signed integer overflow in jv.c:jvp_array_write (CVE-2024-23337)
      * jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10618 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: jq has signed integer overflow in jv.c:jvp_array_write (CVE-2024-23337)

    * jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-10585 advisory.

    - Fix CVE-2025-48060
    - Fix CVE-2024-23337

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:10619 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: jq has signed integer overflow in jv.c:jvp_array_write (CVE-2024-23337)

    * jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:10622 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: jq has signed integer overflow in jv.c:jvp_array_write (CVE-2024-23337)

    * jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:10615 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: jq has signed integer overflow in jv.c:jvp_array_write (CVE-2024-23337)

    * jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:10620 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: jq has signed integer overflow in jv.c:jvp_array_write (CVE-2024-23337)

    * jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10613 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: jq has signed integer overflow in jv.c:jvp_array_write (CVE-2024-23337)

    * jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:10616 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: jq has signed integer overflow in jv.c:jvp_array_write (CVE-2024-23337)

    * jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:10621 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: jq has signed integer overflow in jv.c:jvp_array_write (CVE-2024-23337)

    * jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10585 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: jq has signed integer overflow in jv.c:jvp_array_write (CVE-2024-23337)

    * jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
242000	AlmaLinux 9 : jq (ALSA-2025:10585)	Nessus	Alma Linux Local Security Checks	high
241913	Azure Linux 3.0 Security Update: jq (CVE-2024-23337)	Nessus	Azure Linux Local Security Checks	medium
241876	CBL Mariner 2.0 Security Update: jq (CVE-2024-23337)	Nessus	MarinerOS Local Security Checks	medium
241633	Oracle Linux 8 : jq (ELSA-2025-10618)	Nessus	Oracle Linux Local Security Checks	high
241631	AlmaLinux 8 : jq (ALSA-2025:10618)	Nessus	Alma Linux Local Security Checks	high
241573	RHEL 8 : jq (RHSA-2025:10618)	Nessus	Red Hat Local Security Checks	high
241571	Oracle Linux 9 : jq (ELSA-2025-10585)	Nessus	Oracle Linux Local Security Checks	high
241569	RHEL 8 : jq (RHSA-2025:10619)	Nessus	Red Hat Local Security Checks	high
241568	RHEL 8 : jq (RHSA-2025:10622)	Nessus	Red Hat Local Security Checks	high
241566	RHEL 9 : jq (RHSA-2025:10615)	Nessus	Red Hat Local Security Checks	high
241565	RHEL 8 : jq (RHSA-2025:10620)	Nessus	Red Hat Local Security Checks	high
241539	RHEL 9 : jq (RHSA-2025:10613)	Nessus	Red Hat Local Security Checks	high
241538	RHEL 9 : jq (RHSA-2025:10616)	Nessus	Red Hat Local Security Checks	high
241527	RHEL 8 : jq (RHSA-2025:10621)	Nessus	Red Hat Local Security Checks	high
241526	RHEL 9 : jq (RHSA-2025:10585)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2024-23337

medium

Tenable Plugins

high

medium

medium

high

high

high

high

high

high

high

high

high

high

high

high