An update of the jq package has been released.

The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-39979 advisory.

  - jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the     jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-     handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is     found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in     a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of     the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted     input, and depending on memory layout, can result in memory disclosure or process termination. The issue     has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f. (CVE-2026-39979)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the     jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-     handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is     found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in     a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of     the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted     input, and depending on memory layout, can result in memory disclosure or process termination. The issue     has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f. (CVE-2026-39979)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of CBL-Mariner Releases installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-39979 advisory.

  - jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the     jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-     handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is     found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in     a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of     the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted     input, and depending on memory layout, can result in memory disclosure or process termination. The issue     has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f. (CVE-2026-39979)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4e57162966 advisory.

    Fixes CVE-2026-32316     Fixes CVE-2026-33947     Fixes CVE-2026-39956     Fixes CVE-2026-39979     Fixes CVE-2026-40164

    Fixes <skipped: too deep> bug https://github.com/jqlang/jq/issues/3413

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0eb8e878b6 advisory.

    Fixes CVE-2026-32316     Fixes CVE-2026-33947     Fixes CVE-2026-39956     Fixes CVE-2026-39979     Fixes CVE-2026-40164

    Fixes <skipped: too deep> bug https://github.com/jqlang/jq/issues/3413

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8202-1 advisory.

    It was discovered that jq did not correctly handle certain string concatenations. An attacker could     possibly use this issue to cause a denial of service or execute arbitrary code. This issue was addressed     in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu     25.10. (CVE-2026-32316)

    It was discovered that jq did not correctly handle recursion in certain circumstances. An attacker could     possibly use this issue to cause a denial of service. (CVE-2026-33947)

    It was discovered that jq did not correctly handle improperly terminated strings. An attacker could     possibly use this issue to cause a denial of service or execute arbitrary code. This issue was addressed     in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu     25.10. (CVE-2026-33948)

    It was discovered that jq did not correctly handle checking certain variable types. An attacker could     possibly use this issue to cause a denial of service or leak sensitive information. This issue was     addressed in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and     Ubuntu 25.10. (CVE-2026-39956)

    It was discovered that jq did not correctly handle certain string formatting. An attacker could possibly     use this issue to leak sensitive information or cause a denial of service. (CVE-2026-39979)

    It was discovered that jq used a fixed seed for hash table operations. An attacker could possibly use this     issue to cause a denial of service. This issue was addressed in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu     20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-40164)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-014278 advisory.

    jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the     jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-     handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is     found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in     a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of     the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted     input, and depending on memory layout, can result in memory disclosure or process termination. The issue     has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
310093	Photon OS 4.0: Jq PHSA-2026-4.0-1000	Nessus	PhotonOS Local Security Checks	4/24/2026	4/24/2026	medium
307502	Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2026-39979)	Nessus	Azure Linux Local Security Checks	4/19/2026	4/27/2026	medium
306424	Linux Distros Unpatched Vulnerability : CVE-2026-39979	Nessus	Misc.	4/14/2026	4/29/2026	medium
310268	CBL Mariner 2.0 Security Update: CBL-Mariner Releases (CVE-2026-39979)	Nessus	MarinerOS Local Security Checks	4/25/2026	4/25/2026	medium
307659	Fedora 43 : jq (2026-4e57162966)	Nessus	Fedora Local Security Checks	4/20/2026	4/27/2026	medium
307869	Photon OS 5.0: Jq PHSA-2026-5.0-0827	Nessus	PhotonOS Local Security Checks	4/21/2026	4/27/2026	medium
310207	Fedora 44 : jq (2026-0eb8e878b6)	Nessus	Fedora Local Security Checks	4/25/2026	4/25/2026	medium
310123	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : jq vulnerabilities (USN-8202-1)	Nessus	Ubuntu Local Security Checks	4/24/2026	4/24/2026	medium
310007	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: jq (UTSA-2026-014278)	Nessus	Unity Linux Local Security Checks	4/23/2026	4/27/2026	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

medium