jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens.

An update of the jq package has been released.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4599 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4599-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                  Andreans Henriksson     May 25, 2026                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : jq     Version        : 1.6-2.1+deb11u2     CVE ID         : CVE-2026-32316 CVE-2026-33947 CVE-2026-33948 CVE-2026-39956                      CVE-2026-39979 CVE-2026-40164 CVE-2026-41256 CVE-2026-41257                      CVE-2026-43895 CVE-2026-43896 CVE-2026-44777     Debian Bug     : 1136445

    It was found that jq, a lightweight and flexible command-line JSON parser, was     vulnerable to multiple memory corruption attacks, which could lead to     application crashes, denial-of-service conditions, and potentially arbitrary     code execution through heap corruption when parsing untrusted input.

    For Debian 11 bullseye, these problems have been fixed in version     1.6-2.1+deb11u2.

    We recommend that you upgrade your jq packages.

    For the detailed security status of jq please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/jq

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths     at the jq-language level, but later resolves those paths through C string operations during module and     data-file lookup. This creates a mismatch between the logical import string that policy or audit code may     validate and the on-disk path that jq actually opens. (CVE-2026-43895)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
321792	Photon OS 5.0: Jq PHSA-2026-5.0-0885	Nessus	PhotonOS Local Security Checks	high
316545	Debian dla-4599 : jq - security update	Nessus	Debian Local Security Checks	high
314269	Linux Distros Unpatched Vulnerability : CVE-2026-43895	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-43895

medium

Tenable Plugins

high

high

medium