jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_strflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known fix version exists at time of publication.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within
    the function f_strflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known
    fix version exists at time of publication. (CVE-2025-49014)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005841 advisory.

    jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within     the function f_strflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known     fix version exists at time of publication.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
452471	Google: app-misc/jq: security update to 18867.90.106	Tenable Cloud Security	Google COS Security Checks	Local	medium
452471	Google: app-misc/jq: security update to 18867.90.106	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
451124	Google: app-misc/jq: security update to 18244.448.6	Tenable Cloud Security	Google COS Security Checks	Local	medium
451124	Google: app-misc/jq: security update to 18244.448.6	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
301131	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: jq (UTSA-2026-005841)	Nessus	Unity Linux Local Security Checks	Local	medium
436076	Alpine: jq: security update to 1.8.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	medium
436076	Alpine: jq: security update to 1.8.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	medium

Detections

Analytics

CVE-2025-49014

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium