Medium: yq

Issue Overview: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse ...

Amazon Linux 2023 : yq (ALAS2023-2026-3347)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3347 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by th...

AZL-111760 CVE-2026-97045 affecting package yq 4.45.1-1

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace such as or fostered under ,...

AZL-111757 CVE-2026-78661 affecting package yq 4.45.1-1

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation n.Data += text reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags such as "a" caused...

openSUSE 16 Security Update : yq (openSUSE-SU-2026:21500-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21500-1 advisory. Changes in yq: - Update the golang.org/x/net dependency to version v0.57.0 to fix CVE-2026-39821 for good bsc1267199. - update to v4.53.3 Add...

Security update for yq (important)

openSUSE security update: security update for yq ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21500-1 Rating: important References: bsc1267199 bsc1271994 Cross-References: CVE-2026-39821 CVE-2026-56852 CVSS scores: CVE-2026-39821 SUSE : 7.4...

OPENSUSE-SU-2026:21500-1 Security update for yq

This update for yq fixes the following issues: Changes in yq: - Update the golang.org/x/net dependency to version v0.57.0 to fix CVE-2026-39821 for good bsc1267199. - update to v4.53.3 Add --ini-preserve-quotes flag for INI round-trip quote preservation. Fix: reset INI decoder state on init. Fix:...

SUSE SLES15 Security Update : yq (SUSE-SU-2026:3327-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3327-1 advisory. Update to v4.53.3. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass a...

openSUSE 16 Security Update : yq (openSUSE-SU-2026:21454-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21454-1 advisory. Changes in yq: - Update the golang.org/x/net dependency to version v0.57.0 to fix CVE-2026-39821 for good bsc1267199. - update to v4.53.3 Add...

Security update for yq

This update for yq fixes the following issues: Update to v4.53.3. CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1267199. CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of inpu...

PT-2026-65076

These are all security issues fixed in the yq-4.53.3-1.2 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11382-1 yq-4.53.3-1.2 on GA media

These are all security issues fixed in the yq-4.53.3-1.2 package on the GA media of openSUSE Tumbleweed...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: yq: yq-4.53.3-2.1.hum1 aarch64, x8664 yq-4.53.3-2.1.hum1.src src Security Fixes: yq: CVE-2026-56852...

AZL-93099 CVE-2026-56852 affecting package yq 4.45.1-1

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

[SECURITY] Fedora 43 Update: yq-4.53.3-1.fc43

Yq is a portable command-line YAML, JSON, XML, CSV, TOML, HCL and properties processor...

Fedora 44 : yq (2026-710adfa806)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-710adfa806 advisory. Update to 4.53.3 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Amazon Linux 2023 : yq (ALAS2023-2026-1887)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1887 advisory. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. CVE-2026-25680 Tenable has extracted the preceding description block directly from the tested product...

Important: yq

Issue Overview: Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. CVE-2026-25680 Affected Packages: yq Issue Correction: Run dnf update yq --releasever 2023.12.20260622 or dnf update --advisory ALAS2023-2026-1887 --releasever 2023.12.20260622 to update...

Security update for yq

This update for yq fixes the following issues: CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files bsc1267053. CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows...

SUSE-SU-2026:2285-1 Security update for yq

This update for yq fixes the following issues: - CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files bsc1267053. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels...