jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in
    jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function
    is reachable through the * operator when both operands are objects. (CVE-2026-43896)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779273835 advisory.

  - jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used     MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table     operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON     object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n),     turning any jq expression into an O(n) operation and causing significant CPU exhaustion. This affected     common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more     practical to exploit than existing heap overflow issues since it required only a small payload. This issue     has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784. (CVE-2026-40164)

  - jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects     with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since     the JSON parser caps at depth 10000), the C stack is exhausted. (CVE-2026-40612)

  - jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with
    -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as .
    followed by \x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves     jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON     parser path has already been fixed. (CVE-2026-41256)

  - jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its     allocation size in a signed int. When the stack grows beyond 1 GiB (via deeply nested generator forks),     the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with     attacker-influenced offsets. (CVE-2026-41257)

  - jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number     literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The     wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack     buffer, and then writes 715 million 16-bit units (1.4 GiB) at an offset 1.43 GiB below the stack frame.
    The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).
    (CVE-2026-43894)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779123410 advisory.

  - jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the     jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-     handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is     found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in     a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of     the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted     input, and depending on memory layout, can result in memory disclosure or process termination. The issue     has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f. (CVE-2026-39979)

  - jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used     MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table     operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON     object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n),     turning any jq expression into an O(n) operation and causing significant CPU exhaustion. This affected     common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more     practical to exploit than existing heap overflow issues since it required only a small payload. This issue     has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784. (CVE-2026-40164)

  - jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects     with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since     the JSON parser caps at depth 10000), the C stack is exhausted. (CVE-2026-40612)

  - jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with
    -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as .
    followed by \x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves     jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON     parser path has already been fixed. (CVE-2026-41256)

  - jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its     allocation size in a signed int. When the stack grows beyond 1 GiB (via deeply nested generator forks),     the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with     attacker-influenced offsets. (CVE-2026-41257)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779273835 advisory.

  - jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used     MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table     operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON     object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n),     turning any jq expression into an O(n) operation and causing significant CPU exhaustion. This affected     common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more     practical to exploit than existing heap overflow issues since it required only a small payload. This issue     has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784. (CVE-2026-40164)

  - jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects     with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since     the JSON parser caps at depth 10000), the C stack is exhausted. (CVE-2026-40612)

  - jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with
    -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as .
    followed by \x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves     jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON     parser path has already been fixed. (CVE-2026-41256)

  - jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its     allocation size in a signed int. When the stack grows beyond 1 GiB (via deeply nested generator forks),     the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with     attacker-influenced offsets. (CVE-2026-41257)

  - jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number     literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The     wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack     buffer, and then writes 715 million 16-bit units (1.4 GiB) at an offset 1.43 GiB below the stack frame.
    The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).
    (CVE-2026-43894)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1421 advisory.

    This advisory aggregates security fixes for the jq SRPM in CIQ LTS 9.6. It addresses 8 CVEs:
    CVE-2026-39979, CVE-2026-40164, CVE-2026-32316, CVE-2026-33947, CVE-2026-33948, and 3 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1420 advisory.

    This advisory aggregates security fixes for the jq SRPM in CIQ LTS 9.2. It addresses 8 CVEs:
    CVE-2026-39979, CVE-2026-40164, CVE-2026-32316, CVE-2026-33947, CVE-2026-33948, and 3 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4275-1 advisory.

    Security issues fixed:

    - CVE-2015-8863: heap buffer overflow in tokenadd() function (bsc#976992).
    - CVE-2023-50246: improper memory handling can lead to a heap buffer overflow in `decNumberToString`     (bsc#1218034).
    - CVE-2023-50268: stack-based buffer overflow in builds using decNumber (bsc#1218038).
    - CVE-2024-53427: stack-buffer-overflow in the decNumberCopy function in decNumber.c (bsc#1238078).
    - CVE-2025-9403: reachable assertion in run_jq_tests() (bsc#1248600).
    - CVE-2026-33948: CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).
    - CVE-2026-40164: predictable hash collisions can lead to a denial of service (bsc#1262072).
    - CVE-2026-40612: jv_contains recurses into nested arrays/objects with no depth limit and can cause a     stack overflow       (bsc#1265060).
    - CVE-2026-41256: embedded NUL truncates top-level jq programs loaded with -f and can lead to execution of     unintended       programs (bsc#1265061).
    - CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS     (bsc#1265062).
    - CVE-2026-43894: signed integer overflow in `decNumber` can lead to out-of-bounds memory write     (bsc#1265070).
    - CVE-2026-43895: embedded NUL bytes in import paths can lead to policy bypass and sensitive information     disclosure       (bsc#1265071).
    - CVE-2026-43896: unbounded recursion in `jv_object_merge_recursive()` can lead to C stack exhaustion and     a process       crash (bsc#1265075).
    - CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules `include` each     other can lead       to stack exhaustion and process crash (bsc#1265076).
    - CVE-2026-47770: stack overflow in deep structural equality (bsc#1269221).
    - CVE-2026-49839: `--rawfile` invalid-state reuse after `String too long` can lead to a heap buffer     overflow       (bsc#1269220).
    - CVE-2026-54679: integer overflow in `jvp_string_append` can lead to a buffer overrun on 32-bit systems     (bsc#1269390).

    Changes for jq:

    Update to version 1.7.1:

     * Make the default background color more suitable for bright      backgrounds.
     * Allow passing the inline jq script after --.
     * Fix possible uninitialised value dereference if jq_init() fails
     * Simplify paths/0 and paths/1.
     * Reject U+001F in string literals.
     * Remove unused nref accumulator in block_bind_library.
     * Remove a bunch of unused variables, and useless assignments.
     * main.c: Remove unused EXIT_STATUS_EXACT option.
     * Actually use the number correctly casted from double to int as      index.
     * src/builtin.c: remove unnecessary jv_copy-s in      type_error/type_error2.
     * Remove undefined behavior caught by LLVM 10 UBSAN.
     * Convert decnum to binary64 (double) instead of decimal64.
     This makes jq behave like the JSON specification suggests and      more similar to other languages.
     * Fix memory leaks on invalid input for ltrimstr/1 and      rtrimstr/1.
     * Fix memory leak on failed get for setpath/2.
     * Fix nan from json parsing also for nans with payload that      start with 'n'.
     * Allow carriage return characters in comments.
     * Generate links in the man page.
     * Add extern C for C++.
     * Make object key color configurable using JQ_COLORS environment      variable.
     * Change the default color of null to Bright Black.
     * Respect NO_COLOR environment variable to disable color output.
     * Improved --help output. Now mentions all options and nicer      order.
     * Fix multiple issues of exit code using --exit-code/-e option.
     * Add --raw-output0 for NUL (zero byte) separated output.
     * Fix assert crash and validate JSON for --jsonarg.
     * Remove deprecated --argfile option.
     * Use decimal number literals to preserve precision. Comparison      operations respects precision but arithmetic operations might      truncate.
     * Adds new builtin pick(stream) to emit a projection of the      input object or array.
     * Adds new builtin debug(msgs) that works like debug but applies      a filter on the input before writing to stderr.
     * Adds new builtin scan($re; $flags). Was documented but not      implemented.
     * Adds new builtin abs to get absolute value. This potentially      allows the literal value of numbers to be preserved as length      and fabs convert to float.
     * Allow if without else-branch. When skipped the else-branch      will be . (identity).
     * Allow use of $binding as key in object literals.
     * Allow dot between chained indexes when using .['index']
     * Allow dot for chained value iterator .[], .[]?
     * Fix try/catch catches more than it should.
     * Speed up and refactor some builtins, also remove      scalars_or_empty/0.
     * Now halt and halt_error exit immediately instead of continuing      to the next input.
     * Fix issue converting string to number after previous convert      error.
     * Fix issue representing large numbers on some platforms causing      invalid JSON output.
     * Fix deletion using assigning empty against arrays.
     * Allow keywords to be used as binding name in more places.
     * Allow using nan as NaN in JSON.
     * Expose a module's function names in modulemeta.
     * Fix contains/1 to handle strings with NUL.
     * Fix stderr/0 to output raw text without any decoration.
     * Fix nth/2 to emit empty on index out of range.
     * Fix implode to not assert and instead replace invalid unicode      codepoints.
     * Fix indices/1 and rindex/1 in case of overlapping matches in      strings.
     * Fix sub/3 to resolve issues involving global search-and-replace      (gsub) operations.
     * Fix empty regular expression matches.
     * Fix overflow exception of the modulo operator.
     * Fix string multiplication by 0 (and less than 1) to emit empty      string.
     * Fix segfault when using libjq and threads.
     * Fix constant folding of division and reminder with zero      divisor.
     * Fix error/0, error/1 to throw null error.
     * Simpler and faster transpose.
     * Simple and efficient implementation of walk/1.
     * Remove deprecated filters leaf_paths, recurse_down.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the jq package has been released.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6416 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6416-1                   security@debian.org     https://www.debian.org/security/                                  Aron Xu     August 07, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : jq     CVE ID         : CVE-2024-53427 CVE-2026-32316 CVE-2026-40612 CVE-2026-41256                      CVE-2026-41257 CVE-2026-43894 CVE-2026-43895 CVE-2026-43896                      CVE-2026-44777 CVE-2026-47770 CVE-2026-49839 CVE-2026-54679     Debian Bug     :

    Multiple security issues were discovered in jq, a command-line JSON     processor, which could result in denial of service or potentially the     execution of arbitrary code when processing untrusted input.

    This update additionally addresses three issues for which no CVE has been     assigned: GHSA-ggc9-rpv2-xgpm, GHSA-gvwx-xj9r-3frq and GHSA-gf4g-95wj-4q4r.

    Two changes in behaviour follow from the fixes above. An operation whose     result would exceed the internal string length limit, such as repeating     or escaping a very large string, now terminates with the error String     too long instead of returning a truncated result. A comparison or     containment check on a deeply nested value now reports an error rather     than recursing until the stack is exhausted. Filters relying on the     previous behaviour will report an error where they previously appeared     to succeed.

    For the stable distribution (trixie), these problems have been fixed in     version 1.7.1-6+deb13u3.

    We recommend that you upgrade your jq packages.

    For the detailed security status of jq please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/jq

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22637-1 advisory.

    This update for jq fixes the following issues

    - CVE-2026-43896: unbounded recursion in jv_object_merge_recursive() can lead to C stack exhaustion and a     process crash (bsc#1265075).
    - CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules `include` each     other can lead to stack exhaustion and process crash (bsc#1265076).
    - CVE-2026-49839: fixed a bug where jq --rawfile can turn a handled oversized-string error into invalid-     state reuse and a real heap out-of-bounds write in assertion-disabled builds (bsc#1269220).
    - CVE-2026-54679: integer overflow in jvp_string_append can lead to a buffer overrun on 32-bit systems     (bsc#1269390).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21318-1 advisory.

    This update for jq fixes the following issues

    - CVE-2026-43896: unbounded recursion in jv_object_merge_recursive() can lead to C stack exhaustion and a     process crash (bsc#1265075).
    - CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules `include` each     other can lead to stack exhaustion and process crash (bsc#1265076).
    - CVE-2026-49839: fixed a bug where jq --rawfile can turn a handled oversized-string error into invalid-     state reuse and a real heap out-of-bounds write in assertion-disabled builds (bsc#1269220).
    - CVE-2026-54679: integer overflow in jvp_string_append can lead to a buffer overrun on 32-bit systems     (bsc#1269390).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of jq installed on the remote host is prior to 1.6-17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3496 advisory.

    jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within     the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a     combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation     size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations     then write the full string data into this undersized buffer, causing a heap buffer overflow classified as     CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating     untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further     exploitation through heap corruption by crafting queries that produce extremely large strings. The root     cause is the absence of string size bounds checking, unlike arrays and objects which already have size     limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5. (CVE-2026-32316)

    jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(),     and delpaths_sorted() in jq's src/jv_aux.c use unbounded recursion whose depth is controlled by the length     of a caller-supplied path array, with no depth limit enforced. An attacker can supply a JSON document     containing a flat array of ~65,000 integers (~200 KB) that, when used as a path argument by a trusted jq     filter, exhausts the C call stack and crashes the process with a segmentation fault (SIGSEGV). This bypass     works because the existing MAX_PARSING_DEPTH (10,000) limit only protects the JSON parser, not runtime     path operations where arrays can be programmatically constructed to arbitrary lengths. The impact is     denial of service (unrecoverable crash) affecting any application or service that processes untrusted JSON     input through jq's setpath, getpath, or delpaths builtins. This issue has been addressed in commit     fb59f1491058d58bdc3e8dd28f1773d1ac690a1f. (CVE-2026-33947)

    jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a     vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON     from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from     fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This     enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious     trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix.
    Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are     susceptible to parser differential attacks, as those consumers may process the full input including the     malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.
    (CVE-2026-33948)

    jq is a command-line JSON processor. In commits after 69785bf77f86e2ea1b4a20ca86775916889e91c9, the
    _strindices builtin in jq's src/builtin.c passes its arguments directly to jv_string_indexes() without     verifying they are strings, and jv_string_indexes() in src/jv.c relies solely on assert() checks that are     stripped in release builds compiled with -DNDEBUG. This allows an attacker to crash jq trivially with     input like _strindices(0), and by crafting a numeric value whose IEEE-754 bit pattern maps to a chosen     pointer, achieve a controlled pointer dereference and limited memory read/probe primitive. Any deployment     that evaluates untrusted jq filters against a release build is vulnerable. This issue has been patched in     commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03. (CVE-2026-39956)

    jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the     jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-     handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is     found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in     a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of     the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted     input, and depending on memory layout, can result in memory disclosure or process termination. The issue     has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f. (CVE-2026-39979)

    jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used     MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table     operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON     object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n),     turning any jq expression into an O(n2) operation and causing significant CPU exhaustion. This affected     common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more     practical to exploit than existing heap overflow issues since it required only a small payload. This issue     has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784. (CVE-2026-40164)

    jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in     jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function     is reachable through the * operator when both operands are objects. (CVE-2026-43896)

    The vulnerability is an unbounded recursion in jv_equal() and jv_cmp() that causes a stack overflow when     processing deeply nested JSON structures during equality checks (==, !=) or comparisons (sort, unique,     bsearch, min_by, max_by). (CVE-2026-47770)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4662 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4662-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Andreas Henriksson     July 01, 2026                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : jq     Version        : 1.6-2.1+deb12u2     CVE ID         : CVE-2026-32316 CVE-2026-33947 CVE-2026-33948 CVE-2026-39956                      CVE-2026-39979 CVE-2026-40164 CVE-2026-41256 CVE-2026-41257                      CVE-2026-43894 CVE-2026-43895 CVE-2026-43896 CVE-2026-44777                      CVE-2026-47770 CVE-2026-49839 CVE-2026-54679     Debian Bug     : 1133921 1136445

    It was found that jq, a lightweight and flexible command-line JSON parser, was     vulnerable to multiple memory corruption attacks, which could lead to     application crashes, denial-of-service conditions, and potentially arbitrary     code execution through heap corruption when parsing untrusted input.

    For Debian 12 bookworm, these problems have been fixed in version     1.6-2.1+deb12u2.

    For Debian 11 bullseye, these issues have been addressed in DLA-4599-1 and     DLA-4661-1.

    We recommend that you upgrade your jq packages.

    For the detailed security status of jq please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/jq

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b43264dedb advisory.

    Automatic update for jq-1.8.2-4.fc45.

    ##### **Changelog**

    ```
    * Sat Jun 20 2026 Filipe Rosset <filiperosset@fedoraproject.org> - 1.8.2-4
    - removed old upstreamed patches
    * Sat Jun 20 2026 Filipe Rosset <filiperosset@fedoraproject.org> - 1.8.2-3
    - opt-in to packit for rawhide
    * Sat Jun 20 2026 Filipe Rosset <filiperosset@fedoraproject.org> - 1.8.2-2
    - simplify .gitignore file
    * Sat Jun 20 2026 Filipe Rosset <filiperosset@fedoraproject.org> - 1.8.2-1
    - update to 1.8.2 fixes rhbz#2458354 rhbz#2477179 rhbz#2477180 rhbz#2477235       rhbz#2477236 rhbz#2477522 rhbz#2477523

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1815 advisory.

    jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within     the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a     combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation     size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations     then write the full string data into this undersized buffer, causing a heap buffer overflow classified as     CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating     untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further     exploitation through heap corruption by crafting queries that produce extremely large strings. The root     cause is the absence of string size bounds checking, unlike arrays and objects which already have size     limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5. (CVE-2026-32316)

    jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(),     and delpaths_sorted() in jq's src/jv_aux.c use unbounded recursion whose depth is controlled by the length     of a caller-supplied path array, with no depth limit enforced. An attacker can supply a JSON document     containing a flat array of ~65,000 integers (~200 KB) that, when used as a path argument by a trusted jq     filter, exhausts the C call stack and crashes the process with a segmentation fault (SIGSEGV). This bypass     works because the existing MAX_PARSING_DEPTH (10,000) limit only protects the JSON parser, not runtime     path operations where arrays can be programmatically constructed to arbitrary lengths. The impact is     denial of service (unrecoverable crash) affecting any application or service that processes untrusted JSON     input through jq's setpath, getpath, or delpaths builtins. This issue has been addressed in commit     fb59f1491058d58bdc3e8dd28f1773d1ac690a1f. (CVE-2026-33947)

    jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a     vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON     from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from     fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This     enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious     trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix.
    Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are     susceptible to parser differential attacks, as those consumers may process the full input including the     malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.
    (CVE-2026-33948)

    jq is a command-line JSON processor. In commits after 69785bf77f86e2ea1b4a20ca86775916889e91c9, the
    _strindices builtin in jq's src/builtin.c passes its arguments directly to jv_string_indexes() without     verifying they are strings, and jv_string_indexes() in src/jv.c relies solely on assert() checks that are     stripped in release builds compiled with -DNDEBUG. This allows an attacker to crash jq trivially with     input like _strindices(0), and by crafting a numeric value whose IEEE-754 bit pattern maps to a chosen     pointer, achieve a controlled pointer dereference and limited memory read/probe primitive. Any deployment     that evaluates untrusted jq filters against a release build is vulnerable. This issue has been patched in     commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03. (CVE-2026-39956)

    jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the     jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-     handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is     found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in     a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of     the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted     input, and depending on memory layout, can result in memory disclosure or process termination. The issue     has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f. (CVE-2026-39979)

    jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used     MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table     operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON     object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n),     turning any jq expression into an O(n2) operation and causing significant CPU exhaustion. This affected     common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more     practical to exploit than existing heap overflow issues since it required only a small payload. This issue     has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784. (CVE-2026-40164)

    jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number     literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The     wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack     buffer, and then writes [?]715 million 16-bit units ([?]1.4 GiB) at an offset 1.43 GiB below the stack     frame. The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).
    (CVE-2026-43894)

    jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in     jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function     is reachable through the * operator when both operands are objects. (CVE-2026-43896)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4599 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4599-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                  Andreans Henriksson     May 25, 2026                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : jq     Version        : 1.6-2.1+deb11u2     CVE ID         : CVE-2026-32316 CVE-2026-33947 CVE-2026-33948 CVE-2026-39956                      CVE-2026-39979 CVE-2026-40164 CVE-2026-41256 CVE-2026-41257                      CVE-2026-43895 CVE-2026-43896 CVE-2026-44777     Debian Bug     : 1136445

    It was found that jq, a lightweight and flexible command-line JSON parser, was     vulnerable to multiple memory corruption attacks, which could lead to     application crashes, denial-of-service conditions, and potentially arbitrary     code execution through heap corruption when parsing untrusted input.

    For Debian 11 bullseye, these problems have been fixed in version     1.6-2.1+deb11u2.

    We recommend that you upgrade your jq packages.

    For the detailed security status of jq please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/jq

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in     jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function     is reachable through the * operator when both operands are objects. (CVE-2026-43896)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
464776	Echo: jq: security update to 1.7.1-6+deb13u2+e2	Tenable Cloud Security	Echo Local Security Checks	Local	medium
464776	Echo: jq: security update to 1.7.1-6+deb13u2+e2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
362358	AlmaLinux 9.6 [TuxCare] Security Update: jq / jq-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1779273835)	Nessus	Alma Linux Local Security Checks	Local	high
362160	AlmaLinux 9.2 [TuxCare] Security Update: jq / jq-devel Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1779123410)	Nessus	Alma Linux Local Security Checks	Local	high
362050	Rocky Linux 9.6 [TuxCare] Security Update: jq / jq-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1779273835)	Nessus	Rocky Linux Local Security Checks	Local	high
357247	Rocky Linux 9.6 [CIQ] Security Update: jq / jq-devel Multiple Vulnerabilities (ciqsa-2026_1421)	Nessus	Rocky Linux Local Security Checks	Local	medium
356473	Rocky Linux 9.2 [CIQ] Security Update: jq / jq-devel Multiple Vulnerabilities (ciqsa-2026_1420)	Nessus	Rocky Linux Local Security Checks	Local	medium
348728	SUSE SLED15 / SLES15 Security Update : jq (SUSE-SU-2026:4275-1)	Nessus	SuSE Local Security Checks	Local	high
335105	Photon OS 5.0: Jq PHSA-2026-5.0-92-0885	Nessus	PhotonOS Local Security Checks	Local	high
333519	Debian dsa-6416 : jq - security update	Nessus	Debian Local Security Checks	Local	high
332736	Photon OS 5.0: Jq PHSA-2026-5.0-91-0885	Nessus	PhotonOS Local Security Checks	Local	high
327564	SUSE SLES16 Security Update : jq (SUSE-SU-2026:22637-1)	Nessus	SuSE Local Security Checks	Local	medium
327243	openSUSE 16 Security Update : jq (openSUSE-SU-2026:21318-1)	Nessus	SuSE Local Security Checks	Local	medium
325564	Amazon Linux 2 : jq, --advisory ALAS2-2026-3496 (ALAS-2026-3496)	Nessus	Amazon Linux Local Security Checks	Local	medium
324575	Debian dla-4662 : jq - security update	Nessus	Debian Local Security Checks	Local	high
324000	Fedora 45 : jq (2026-b43264dedb)	Nessus	Fedora Local Security Checks	Local	high
321792	Photon OS 5.0: Jq PHSA-2026-5.0-0885	Nessus	PhotonOS Local Security Checks	Local	high
319811	Amazon Linux 2023 : jq, jq-devel (ALAS2023-2026-1815)	Nessus	Amazon Linux Local Security Checks	Local	medium
316545	Debian dla-4599 : jq - security update	Nessus	Debian Local Security Checks	Local	high
314260	Linux Distros Unpatched Vulnerability : CVE-2026-43896	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-43896

medium

Tenable Plugins

medium

medium

high

high

high

medium

medium

high

high

high

high

medium

medium

medium

high

high

high

medium

high

medium