The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0eb8e878b6 advisory.

    Fixes CVE-2026-32316     Fixes CVE-2026-33947     Fixes CVE-2026-39956     Fixes CVE-2026-39979     Fixes CVE-2026-40164

    Fixes <skipped: too deep> bug https://github.com/jqlang/jq/issues/3413

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4e57162966 advisory.

    Fixes CVE-2026-32316     Fixes CVE-2026-33947     Fixes CVE-2026-39956     Fixes CVE-2026-39979     Fixes CVE-2026-40164

    Fixes <skipped: too deep> bug https://github.com/jqlang/jq/issues/3413

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the jq package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(),     and delpaths_sorted() in jq's src/jv_aux.c use unbounded recursion whose depth is controlled by the length     of a caller-supplied path array, with no depth limit enforced. An attacker can supply a JSON document     containing a flat array of ~65,000 integers (~200 KB) that, when used as a path argument by a trusted jq     filter, exhausts the C call stack and crashes the process with a segmentation fault (SIGSEGV). This bypass     works because the existing MAX_PARSING_DEPTH (10,000) limit only protects the JSON parser, not runtime     path operations where arrays can be programmatically constructed to arbitrary lengths. The impact is     denial of service (unrecoverable crash) affecting any application or service that processes untrusted JSON     input through jq's setpath, getpath, or delpaths builtins. This issue has been addressed in commit     fb59f1491058d58bdc3e8dd28f1773d1ac690a1f. (CVE-2026-33947)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of CBL-Mariner Releases installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-33947 advisory.

  - jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(),     and delpaths_sorted() in jq's src/jv_aux.c use unbounded recursion whose depth is controlled by the length     of a caller-supplied path array, with no depth limit enforced. An attacker can supply a JSON document     containing a flat array of ~65,000 integers (~200 KB) that, when used as a path argument by a trusted jq     filter, exhausts the C call stack and crashes the process with a segmentation fault (SIGSEGV). This bypass     works because the existing MAX_PARSING_DEPTH (10,000) limit only protects the JSON parser, not runtime     path operations where arrays can be programmatically constructed to arbitrary lengths. The impact is     denial of service (unrecoverable crash) affecting any application or service that processes untrusted JSON     input through jq's setpath, getpath, or delpaths builtins. This issue has been addressed in commit     fb59f1491058d58bdc3e8dd28f1773d1ac690a1f. (CVE-2026-33947)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-33947 advisory.

  - jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(),     and delpaths_sorted() in jq's src/jv_aux.c use unbounded recursion whose depth is controlled by the length     of a caller-supplied path array, with no depth limit enforced. An attacker can supply a JSON document     containing a flat array of ~65,000 integers (~200 KB) that, when used as a path argument by a trusted jq     filter, exhausts the C call stack and crashes the process with a segmentation fault (SIGSEGV). This bypass     works because the existing MAX_PARSING_DEPTH (10,000) limit only protects the JSON parser, not runtime     path operations where arrays can be programmatically constructed to arbitrary lengths. The impact is     denial of service (unrecoverable crash) affecting any application or service that processes untrusted JSON     input through jq's setpath, getpath, or delpaths builtins. This issue has been addressed in commit     fb59f1491058d58bdc3e8dd28f1773d1ac690a1f. (CVE-2026-33947)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8202-1 advisory.

    It was discovered that jq did not correctly handle certain string concatenations. An attacker could     possibly use this issue to cause a denial of service or execute arbitrary code. This issue was addressed     in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu     25.10. (CVE-2026-32316)

    It was discovered that jq did not correctly handle recursion in certain circumstances. An attacker could     possibly use this issue to cause a denial of service. (CVE-2026-33947)

    It was discovered that jq did not correctly handle improperly terminated strings. An attacker could     possibly use this issue to cause a denial of service or execute arbitrary code. This issue was addressed     in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu     25.10. (CVE-2026-33948)

    It was discovered that jq did not correctly handle checking certain variable types. An attacker could     possibly use this issue to cause a denial of service or leak sensitive information. This issue was     addressed in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and     Ubuntu 25.10. (CVE-2026-39956)

    It was discovered that jq did not correctly handle certain string formatting. An attacker could possibly     use this issue to leak sensitive information or cause a denial of service. (CVE-2026-39979)

    It was discovered that jq used a fixed seed for hash table operations. An attacker could possibly use this     issue to cause a denial of service. This issue was addressed in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu     20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-40164)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-014276 advisory.

    jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(),     and delpaths_sorted() in jq's src/jv_aux.c use unbounded recursion whose depth is controlled by the length     of a caller-supplied path array, with no depth limit enforced. An attacker can supply a JSON document     containing a flat array of ~65,000 integers (~200 KB) that, when used as a path argument by a trusted jq     filter, exhausts the C call stack and crashes the process with a segmentation fault (SIGSEGV). This bypass     works because the existing MAX_PARSING_DEPTH (10,000) limit only protects the JSON parser, not runtime     path operations where arrays can be programmatically constructed to arbitrary lengths. The impact is     denial of service (unrecoverable crash) affecting any application or service that processes untrusted JSON     input through jq's setpath, getpath, or delpaths builtins. This issue has been addressed in commit     fb59f1491058d58bdc3e8dd28f1773d1ac690a1f.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
310207	Fedora 44 : jq (2026-0eb8e878b6)	Nessus	Fedora Local Security Checks	4/25/2026	4/25/2026	medium
307659	Fedora 43 : jq (2026-4e57162966)	Nessus	Fedora Local Security Checks	4/20/2026	4/27/2026	medium
307869	Photon OS 5.0: Jq PHSA-2026-5.0-0827	Nessus	PhotonOS Local Security Checks	4/21/2026	4/27/2026	medium
306411	Linux Distros Unpatched Vulnerability : CVE-2026-33947	Nessus	Misc.	4/14/2026	4/23/2026	medium
310093	Photon OS 4.0: Jq PHSA-2026-4.0-1000	Nessus	PhotonOS Local Security Checks	4/24/2026	4/24/2026	medium
310263	CBL Mariner 2.0 Security Update: CBL-Mariner Releases (CVE-2026-33947)	Nessus	MarinerOS Local Security Checks	4/25/2026	4/25/2026	medium
307501	Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2026-33947)	Nessus	Azure Linux Local Security Checks	4/19/2026	4/23/2026	medium
310123	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : jq vulnerabilities (USN-8202-1)	Nessus	Ubuntu Local Security Checks	4/24/2026	4/24/2026	medium
310004	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: jq (UTSA-2026-014276)	Nessus	Unity Linux Local Security Checks	4/23/2026	4/27/2026	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

medium