jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvp_string_append has a chance of integer/multiple overflowing and then causing a massive buffer overrun. This vulnerability is fixed in 1.8.2.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22637-1 advisory.

    This update for jq fixes the following issues

    - CVE-2026-43896: unbounded recursion in jv_object_merge_recursive() can lead to C stack exhaustion and a     process crash (bsc#1265075).
    - CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules `include` each     other can lead to stack exhaustion and process crash (bsc#1265076).
    - CVE-2026-49839: fixed a bug where jq --rawfile can turn a handled oversized-string error into invalid-     state reuse and a real heap out-of-bounds write in assertion-disabled builds (bsc#1269220).
    - CVE-2026-54679: integer overflow in jvp_string_append can lead to a buffer overrun on 32-bit systems     (bsc#1269390).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21318-1 advisory.

    This update for jq fixes the following issues

    - CVE-2026-43896: unbounded recursion in jv_object_merge_recursive() can lead to C stack exhaustion and a     process crash (bsc#1265075).
    - CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules `include` each     other can lead to stack exhaustion and process crash (bsc#1265076).
    - CVE-2026-49839: fixed a bug where jq --rawfile can turn a handled oversized-string error into invalid-     state reuse and a real heap out-of-bounds write in assertion-disabled builds (bsc#1269220).
    - CVE-2026-54679: integer overflow in jvp_string_append can lead to a buffer overrun on 32-bit systems     (bsc#1269390).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4662 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4662-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Andreas Henriksson     July 01, 2026                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : jq     Version        : 1.6-2.1+deb12u2     CVE ID         : CVE-2026-32316 CVE-2026-33947 CVE-2026-33948 CVE-2026-39956                      CVE-2026-39979 CVE-2026-40164 CVE-2026-41256 CVE-2026-41257                      CVE-2026-43894 CVE-2026-43895 CVE-2026-43896 CVE-2026-44777                      CVE-2026-47770 CVE-2026-49839 CVE-2026-54679     Debian Bug     : 1133921 1136445

    It was found that jq, a lightweight and flexible command-line JSON parser, was     vulnerable to multiple memory corruption attacks, which could lead to     application crashes, denial-of-service conditions, and potentially arbitrary     code execution through heap corruption when parsing untrusted input.

    For Debian 12 bookworm, these problems have been fixed in version     1.6-2.1+deb12u2.

    For Debian 11 bullseye, these issues have been addressed in DLA-4599-1 and     DLA-4661-1.

    We recommend that you upgrade your jq packages.

    For the detailed security status of jq please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/jq

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4661 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4661-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Andreas Henriksson     July 01, 2026                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : jq     Version        : 1.6-2.1+deb11u3     CVE ID         : CVE-2026-43894 CVE-2026-47770 CVE-2026-49839 CVE-2026-54679     Debian Bug     : 1136445

    It was found that jq, a lightweight and flexible command-line JSON parser, was     vulnerable to multiple memory corruption attacks, which could lead to     application crashes, denial-of-service conditions, and potentially arbitrary     code execution through heap corruption when parsing untrusted input.

    For Debian 11 bullseye, these problems have been fixed in version     1.6-2.1+deb11u3.

    We recommend that you upgrade your jq packages.

    For the detailed security status of jq please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/jq

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvp_string_append has a chance of     integer/multiple overflowing and then causing a massive buffer overrun. This vulnerability is fixed in     1.8.2. (CVE-2026-54679)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
327564	SUSE SLES16 Security Update : jq (SUSE-SU-2026:22637-1)	Nessus	SuSE Local Security Checks	medium
327243	openSUSE 16 Security Update : jq (openSUSE-SU-2026:21318-1)	Nessus	SuSE Local Security Checks	medium
324575	Debian dla-4662 : jq - security update	Nessus	Debian Local Security Checks	high
324574	Debian dla-4661 : jq - security update	Nessus	Debian Local Security Checks	medium
323308	Linux Distros Unpatched Vulnerability : CVE-2026-54679	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-54679

medium

Tenable Plugins

medium

medium

high

medium

medium