Detections
Analytics

Echo: jq: security update to 1.7.1-6+deb13u1+e2

high Tenable Cloud Security Plugin ID 457470

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within
 the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a
 combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation
 size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations
 then write the full string data into this undersized buffer, causing a heap buffer overflow classified as
 CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating
 untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further
 exploitation through heap corruption by crafting queries that produce extremely large strings. The root
 cause is the absence of string size bounds checking, unlike arrays and objects which already have size
 limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5. (CVE-2026-32316)

Solution

Update the jq library and its related packages to version 1.7.1-6+deb13u1+e2 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-32316

Plugin Details

Severity: High

ID: 457470

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5.7

Percentile: 96.44

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-32316

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/14/2026

Vulnerability Publication Date: 11/13/2025

Reference Information

CVE: CVE-2026-32316

IAVB: 2025-B-0188