jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.

The version of CBL-Mariner Releases installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-33948 advisory.

  - jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a     vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON     from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from     fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This     enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious     trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix.
    Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are     susceptible to parser differential attacks, as those consumers May process the full input including the     malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.
    (CVE-2026-33948)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8202-1 advisory.

    It was discovered that jq did not correctly handle certain string concatenations. An attacker could     possibly use this issue to cause a denial of service or execute arbitrary code. This issue was addressed     in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu     25.10. (CVE-2026-32316)

    It was discovered that jq did not correctly handle recursion in certain circumstances. An attacker could     possibly use this issue to cause a denial of service. (CVE-2026-33947)

    It was discovered that jq did not correctly handle improperly terminated strings. An attacker could     possibly use this issue to cause a denial of service or execute arbitrary code. This issue was addressed     in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu     25.10. (CVE-2026-33948)

    It was discovered that jq did not correctly handle checking certain variable types. An attacker could     possibly use this issue to cause a denial of service or leak sensitive information. This issue was     addressed in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and     Ubuntu 25.10. (CVE-2026-39956)

    It was discovered that jq did not correctly handle certain string formatting. An attacker could possibly     use this issue to leak sensitive information or cause a denial of service. (CVE-2026-39979)

    It was discovered that jq used a fixed seed for hash table operations. An attacker could possibly use this     issue to cause a denial of service. This issue was addressed in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu     20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-40164)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the jq package has been released.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-014279 advisory.

    jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a     vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON     from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from     fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This     enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious     trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix.
    Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are     susceptible to parser differential attacks, as those consumers may process the full input including the     malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-33948 advisory.

  - jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a     vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON     from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from     fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This     enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious     trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix.
    Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are     susceptible to parser differential attacks, as those consumers May process the full input including the     malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.
    (CVE-2026-33948)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a     vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON     from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from     fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This     enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious     trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix.
    Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are     susceptible to parser differential attacks, as those consumers may process the full input including the     malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.
    (CVE-2026-33948)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
310266	CBL Mariner 2.0 Security Update: CBL-Mariner Releases (CVE-2026-33948)	Nessus	MarinerOS Local Security Checks	medium
310123	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : jq vulnerabilities (USN-8202-1)	Nessus	Ubuntu Local Security Checks	medium
310093	Photon OS 4.0: Jq PHSA-2026-4.0-1000	Nessus	PhotonOS Local Security Checks	medium
310018	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: jq (UTSA-2026-014279)	Nessus	Unity Linux Local Security Checks	medium
307869	Photon OS 5.0: Jq PHSA-2026-5.0-0827	Nessus	PhotonOS Local Security Checks	medium
307506	Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2026-33948)	Nessus	Azure Linux Local Security Checks	medium
306406	Linux Distros Unpatched Vulnerability : CVE-2026-33948	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-33948

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium