Detections
Analytics

Echo: jq: security update to 1.7.1-6+deb13u1+e2

medium Tenable Cloud Security Plugin ID 457998

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(),
 and delpaths_sorted() in jq's src/jv_aux.c use unbounded recursion whose depth is controlled by the length
 of a caller-supplied path array, with no depth limit enforced. An attacker can supply a JSON document
 containing a flat array of ~65,000 integers (~200 KB) that, when used as a path argument by a trusted jq
 filter, exhausts the C call stack and crashes the process with a segmentation fault (SIGSEGV). This bypass
 works because the existing MAX_PARSING_DEPTH (10,000) limit only protects the JSON parser, not runtime
 path operations where arrays can be programmatically constructed to arbitrary lengths. The impact is
 denial of service (unrecoverable crash) affecting any application or service that processes untrusted JSON
 input through jq's setpath, getpath, or delpaths builtins. This issue has been addressed in commit
 fb59f1491058d58bdc3e8dd28f1773d1ac690a1f. (CVE-2026-33947)

Solution

Update the jq library and its related packages to version 1.7.1-6+deb13u1+e2 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-33947

Plugin Details

Severity: Medium

ID: 457998

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.11

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-33947

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 5

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/15/2026

Vulnerability Publication Date: 11/13/2025

Reference Information

CVE: CVE-2026-33947

IAVB: 2025-B-0188