jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n), turning any jq expression into an O(n²) operation and causing significant CPU exhaustion. This affected common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more practical to exploit than existing heap overflow issues since it required only a small payload. This issue has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784.

The version of CBL-Mariner Releases installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-40164 advisory.

  - jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used     MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table     operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON     object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n),     turning any jq expression into an O(n) operation and causing significant CPU exhaustion. This affected     common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more     practical to exploit than existing heap overflow issues since it required only a small payload. This issue     has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784. (CVE-2026-40164)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0eb8e878b6 advisory.

    Fixes CVE-2026-32316     Fixes CVE-2026-33947     Fixes CVE-2026-39956     Fixes CVE-2026-39979     Fixes CVE-2026-40164

    Fixes <skipped: too deep> bug https://github.com/jqlang/jq/issues/3413

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8202-1 advisory.

    It was discovered that jq did not correctly handle certain string concatenations. An attacker could     possibly use this issue to cause a denial of service or execute arbitrary code. This issue was addressed     in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu     25.10. (CVE-2026-32316)

    It was discovered that jq did not correctly handle recursion in certain circumstances. An attacker could     possibly use this issue to cause a denial of service. (CVE-2026-33947)

    It was discovered that jq did not correctly handle improperly terminated strings. An attacker could     possibly use this issue to cause a denial of service or execute arbitrary code. This issue was addressed     in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu     25.10. (CVE-2026-33948)

    It was discovered that jq did not correctly handle checking certain variable types. An attacker could     possibly use this issue to cause a denial of service or leak sensitive information. This issue was     addressed in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and     Ubuntu 25.10. (CVE-2026-39956)

    It was discovered that jq did not correctly handle certain string formatting. An attacker could possibly     use this issue to leak sensitive information or cause a denial of service. (CVE-2026-39979)

    It was discovered that jq used a fixed seed for hash table operations. An attacker could possibly use this     issue to cause a denial of service. This issue was addressed in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu     20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-40164)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the jq package has been released.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-014272 advisory.

    jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used     MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table     operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON     object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n),     turning any jq expression into an O(n) operation and causing significant CPU exhaustion. This affected     common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more     practical to exploit than existing heap overflow issues since it required only a small payload. This issue     has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4e57162966 advisory.

    Fixes CVE-2026-32316     Fixes CVE-2026-33947     Fixes CVE-2026-39956     Fixes CVE-2026-39979     Fixes CVE-2026-40164

    Fixes <skipped: too deep> bug https://github.com/jqlang/jq/issues/3413

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-40164 advisory.

  - jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used     MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table     operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON     object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n),     turning any jq expression into an O(n) operation and causing significant CPU exhaustion. This affected     common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more     practical to exploit than existing heap overflow issues since it required only a small payload. This issue     has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784. (CVE-2026-40164)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used     MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table     operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON     object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n),     turning any jq expression into an O(n) operation and causing significant CPU exhaustion. This affected     common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more     practical to exploit than existing heap overflow issues since it required only a small payload. This issue     has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784. (CVE-2026-40164)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
310264	CBL Mariner 2.0 Security Update: CBL-Mariner Releases (CVE-2026-40164)	Nessus	MarinerOS Local Security Checks	high
310207	Fedora 44 : jq (2026-0eb8e878b6)	Nessus	Fedora Local Security Checks	medium
310123	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : jq vulnerabilities (USN-8202-1)	Nessus	Ubuntu Local Security Checks	medium
310093	Photon OS 4.0: Jq PHSA-2026-4.0-1000	Nessus	PhotonOS Local Security Checks	medium
309986	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: jq (UTSA-2026-014272)	Nessus	Unity Linux Local Security Checks	high
307869	Photon OS 5.0: Jq PHSA-2026-5.0-0827	Nessus	PhotonOS Local Security Checks	medium
307659	Fedora 43 : jq (2026-4e57162966)	Nessus	Fedora Local Security Checks	medium
307505	Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2026-40164)	Nessus	Azure Linux Local Security Checks	high
306412	Linux Distros Unpatched Vulnerability : CVE-2026-40164	Nessus	Misc.	high

Detections

Analytics

CVE-2026-40164

high

Tenable Plugins

high

medium

medium

medium

high

medium

medium

high

high