K000163111: jq vulnerability CVE-2026-40164

Security Advisory Description jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed 0x432A9843 for all JSON object hash table operations, which allowed an attacker to precompute key collisions...

[SECURITY] [DSA 6416-1] jq security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6416-1 [email protected] https://www.debian.org/security/ Aron Xu August 07, 2026 https://www.debian.org/security/faq -...

The vulnerability of the decNumberFromString() function in the jq JSON file processing tool allows a attacker to cause a service failure.

The vulnerability of the decNumberFromString function in the jq JSON processing tool is related to integer overflow. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the jv_object_merge_recursive() function in the jq JSON processing tool allows a attacker to cause a service failure.

The vulnerability of the jvobjectmergerecursive function in the jq JSON processing tool is related to an uncontrolled recursion. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability in the src/linker.c file of the jq JSON processing tool allows a attacker to cause a service failure.

The vulnerability in the src/linker.c file of the jq JSON processing tool lies in the lack of measures taken to eliminate the zero byte or NUL character. Exploiting this vulnerability could allow an attacker to cause a service failure...

[SECURITY] Fedora 43 Update: yq-4.53.3-1.fc43

Yq is a portable command-line YAML, JSON, XML, CSV, TOML, HCL and properties processor...

ROS-20260708-73-0050

The vulnerability of the jq JSON processing tool lies in the use of a hash function that does not meet security requirements. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information or cause service failures...

OESA-2026-2804 jq security update

jq is a lightweight and flexible command-line JSON processor. you can use it to slice and filter and map and transform structured data. It is written in portable C, and it has zero runtime dependencies. it can mangle the data format that you have into the one that you want. Security Fixes: jq is ...

SUSE CVE-2026-49839

jq is a command-line JSON processor. Prior to 1.8.2, jq --rawfile can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds. When jvloadfileraw=1 reads an attacker-controlled file, it repeatedly appends file chunks to the...

CVE-2026-54679

jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvpstringappend has a chance of integer/multiple overflowing and then causing a massive buffer overrun. This vulnerability is fixed in 1.8.2...

AZL-90273 CVE-2026-47770 affecting package jq for versions less than 1.7.1-8

jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion uncontrolled recursion. The crash occurs in jq's recursive...

CVE-2026-47770

The CVE-2026-47770 issue affects jq (the JSON processor) where comparing deeply nested arrays with the == operator can cause stack exhaustion via recursive structural comparison in src/jv.c (jvp_array_equal, jv_equal) and overflow in jv_cmp in src/jv_aux.c. This leads to a denial of service on at...

CVE-2026-47770

jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion uncontrolled recursion. The crash occurs in jq's recursive...

CVE-2026-54679

jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvpstringappend has a chance of integer/multiple overflowing and then causing a massive buffer overrun. This vulnerability is fixed in 1.8.2...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: jq: jq-1.8.2-0.1.hum1 aarch64, x8664 jq-devel-1.8.2-0.1.hum1 aarch64, x8664 jq-1.8.2-0.1.hum1.src src...

jq: jq: Denial of Service via crafted JSON object causing hash collisions

A flaw was found in jq, a command-line JSON processor. A remote attacker could exploit this vulnerability by providing a specially crafted JSON object. This object leverages a weakness in jq's hashing algorithm, which uses a hardcoded, publicly known seed. By crafting the JSON object to cause has...

Important: Red Hat Security Advisory: jq security update

An update for jq is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

ALPINE-CVE-2026-44777

jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two otherwise valid modules include each other...

AZL-86645 CVE-2026-44777 affecting package jq for versions less than 1.7.1-6

jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two otherwise valid modules include each other...

AZL-86378 CVE-2026-43895 affecting package jq for versions less than 1.7.1-6

jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy o...