jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.

An update of the jq package has been released.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6416 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6416-1                   security@debian.org     https://www.debian.org/security/                                  Aron Xu     August 07, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : jq     CVE ID         : CVE-2024-53427 CVE-2026-32316 CVE-2026-40612 CVE-2026-41256                      CVE-2026-41257 CVE-2026-43894 CVE-2026-43895 CVE-2026-43896                      CVE-2026-44777 CVE-2026-47770 CVE-2026-49839 CVE-2026-54679     Debian Bug     :

    Multiple security issues were discovered in jq, a command-line JSON     processor, which could result in denial of service or potentially the     execution of arbitrary code when processing untrusted input.

    This update additionally addresses three issues for which no CVE has been     assigned: GHSA-ggc9-rpv2-xgpm, GHSA-gvwx-xj9r-3frq and GHSA-gf4g-95wj-4q4r.

    Two changes in behaviour follow from the fixes above. An operation whose     result would exceed the internal string length limit, such as repeating     or escaping a very large string, now terminates with the error String     too long instead of returning a truncated result. A comparison or     containment check on a deeply nested value now reports an error rather     than recursing until the stack is exhausted. Filters relying on the     previous behaviour will report an error where they previously appeared     to succeed.

    For the stable distribution (trixie), these problems have been fixed in     version 1.7.1-6+deb13u3.

    We recommend that you upgrade your jq packages.

    For the detailed security status of jq please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/jq

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21248-1 advisory.

    - CVE-2025-48060: improper handling of string data in `jv_string_empty` can lead to heap buffer overflow     and a crash       when processing crafted input (bsc#1244116).
    - CVE-2026-32316: integer overflow within the `jvp_string_append()` and `jvp_string_copy_replace_bad`     functions can       lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).
    - CVE-2026-33947: unbounded recursion in functions `jv_setpath()`, `jv_getpath()`, and `delpaths_sorted()`     can lead to       excessive resource consumption when processing crafted JSON input (bsc#1262069).
    - CVE-2026-39956: missing runtime type checks in `_strindices` and `jv_string_indexes()` can lead to a     crash when       evaluating untrusted jq filters against a release build (bsc#1262070).
    - CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in `jv_parse_sized` can lead     to an       out-of-bounds read when processing malformed JSON (bsc#1262071).
    - CVE-2026-40164: use of `MurmurHash3` with a hardcoded seed allows pre-computation of key collisions and     can lead to a       denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).
    - CVE-2026-40612: recursion into nested arrays/objects with no depth limit in `jv_contains` can lead to a     C stack       exhaustion when processing crafted input (bsc#1265060).
    - CVE-2026-41256: truncation of top-level jq programs loaded with `-f` and can lead to the execution of     unintended       programs (bsc#1265061).
    - CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS when     processing jq       bytecode (bsc#1265062).
    - CVE-2026-43894: signed integer overflow in the `decNumberFromString` `D2U()` macro can lead to an out-     of-bounds       memory write when processing large number literals (bsc#1265070).
    - CVE-2026-33948: improper handling of buffer sizes via `strlen()` instead of `fgets()` in CLI input     parsing allows       validation bypass via embedded NUL bytes (bsc#1262043).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4662 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4662-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Andreas Henriksson     July 01, 2026                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : jq     Version        : 1.6-2.1+deb12u2     CVE ID         : CVE-2026-32316 CVE-2026-33947 CVE-2026-33948 CVE-2026-39956                      CVE-2026-39979 CVE-2026-40164 CVE-2026-41256 CVE-2026-41257                      CVE-2026-43894 CVE-2026-43895 CVE-2026-43896 CVE-2026-44777                      CVE-2026-47770 CVE-2026-49839 CVE-2026-54679     Debian Bug     : 1133921 1136445

    It was found that jq, a lightweight and flexible command-line JSON parser, was     vulnerable to multiple memory corruption attacks, which could lead to     application crashes, denial-of-service conditions, and potentially arbitrary     code execution through heap corruption when parsing untrusted input.

    For Debian 12 bookworm, these problems have been fixed in version     1.6-2.1+deb12u2.

    For Debian 11 bullseye, these issues have been addressed in DLA-4599-1 and     DLA-4661-1.

    We recommend that you upgrade your jq packages.

    For the detailed security status of jq please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/jq

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b43264dedb advisory.

    Automatic update for jq-1.8.2-4.fc45.

    ##### **Changelog**

    ```
    * Sat Jun 20 2026 Filipe Rosset <filiperosset@fedoraproject.org> - 1.8.2-4
    - removed old upstreamed patches
    * Sat Jun 20 2026 Filipe Rosset <filiperosset@fedoraproject.org> - 1.8.2-3
    - opt-in to packit for rawhide
    * Sat Jun 20 2026 Filipe Rosset <filiperosset@fedoraproject.org> - 1.8.2-2
    - simplify .gitignore file
    * Sat Jun 20 2026 Filipe Rosset <filiperosset@fedoraproject.org> - 1.8.2-1
    - update to 1.8.2 fixes rhbz#2458354 rhbz#2477179 rhbz#2477180 rhbz#2477235       rhbz#2477236 rhbz#2477522 rhbz#2477523

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4599 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4599-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                  Andreans Henriksson     May 25, 2026                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : jq     Version        : 1.6-2.1+deb11u2     CVE ID         : CVE-2026-32316 CVE-2026-33947 CVE-2026-33948 CVE-2026-39956                      CVE-2026-39979 CVE-2026-40164 CVE-2026-41256 CVE-2026-41257                      CVE-2026-43895 CVE-2026-43896 CVE-2026-44777     Debian Bug     : 1136445

    It was found that jq, a lightweight and flexible command-line JSON parser, was     vulnerable to multiple memory corruption attacks, which could lead to     application crashes, denial-of-service conditions, and potentially arbitrary     code execution through heap corruption when parsing untrusted input.

    For Debian 11 bullseye, these problems have been fixed in version     1.6-2.1+deb11u2.

    We recommend that you upgrade your jq packages.

    For the detailed security status of jq please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/jq

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its     allocation size in a signed int. When the stack grows beyond 1 GiB (via deeply nested generator forks),     the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with     attacker-influenced offsets. (CVE-2026-41257)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
335105	Photon OS 5.0: Jq PHSA-2026-5.0-92-0885	Nessus	PhotonOS Local Security Checks	Local	high
333519	Debian dsa-6416 : jq - security update	Nessus	Debian Local Security Checks	Local	high
332736	Photon OS 5.0: Jq PHSA-2026-5.0-91-0885	Nessus	PhotonOS Local Security Checks	Local	high
326028	openSUSE 16 Security Update : jq (openSUSE-SU-2026:21248-1)	Nessus	SuSE Local Security Checks	Local	high
324575	Debian dla-4662 : jq - security update	Nessus	Debian Local Security Checks	Local	high
324000	Fedora 45 : jq (2026-b43264dedb)	Nessus	Fedora Local Security Checks	Local	high
321792	Photon OS 5.0: Jq PHSA-2026-5.0-0885	Nessus	PhotonOS Local Security Checks	Local	high
316545	Debian dla-4599 : jq - security update	Nessus	Debian Local Security Checks	Local	high
314264	Linux Distros Unpatched Vulnerability : CVE-2026-41257	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-41257

high

Tenable Plugins

high

high

high

high

high

high

high

high

high