RHSA-2026:8579
Vulnerability from csaf_redhat - Published: 2026-04-16 20:52 - Updated: 2026-04-22 16:37Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
jq:
* jq-1.8.1-3.hum1 (aarch64, x86_64)
* jq-devel-1.8.1-3.hum1 (aarch64, x86_64)
* jq-1.8.1-3.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jq, a command-line JSON processor. An attacker can exploit an integer overflow vulnerability by crafting queries that produce extremely large strings. This causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, leading to a drastically undersized memory buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap-based buffer overflow. This can result in a Denial of Service (DoS) by crashing the process or potentially allow for further exploitation through heap corruption.
6.8 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:8579
Workaround
To mitigate this issue, avoid processing untrusted or unvalidated JSON input with the `jq` utility. Ensure that any scripts or automated processes utilizing `jq` only operate on trusted data sources. Restricting the execution of `jq` to trusted users and environments can also reduce exposure.
A flaw was found in jq, a command line JSON processor. Processing a crafted JSON document, specifically when a large array is used as a path argument to the `jv_setpath`, `jv_getpath` and `delpaths_sorted` functions can lead to an uncontrolled recursion and exhausts the call stack, causing an application crash and resulting in a denial of service.
6.2 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:8579
Workaround
Do not process untrusted input with the jq command line JSON processor.
A flaw was found in jq, a command-line JSON processor. This vulnerability allows a remote attacker to bypass input validation by crafting malicious JSON input containing embedded null (NUL) bytes. Due to incorrect handling of input buffer lengths, jq truncates the input at the first NUL byte, validating only the benign prefix and silently discarding any malicious data that follows. This can lead to parser differential attacks where downstream systems, relying on jq for validation, may process the full, unvalidated input, potentially leading to unexpected behavior or security compromises.
CWE-170 - Improper Null Termination
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:8579
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
A flaw was found in jq, a command line JSON processor. In release builds, the `_strindices` builtin function calls the `jv_string_indexes` function without checking that the arguments are actually strings. This missing validation allows an attacker who can supply non-string inputs to cause an application crash and a limited memory read.
6.1 (Medium)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:8579
Workaround
Do not use untrusted input as an argument to a jq builtin, specifically '_strindices'.
A flaw was found in jq, a command line JSON processor, specifically in the libjq API. Parsing a malformed JSON input from a non-NUL-terminated buffer using the `jv_parse_sized` function can cause an out-of-bounds read, resulting in an application crash and a possible memory disclosure within the error message generated by the parser.
8.2 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:8579
Workaround
To mitigate this issue, manually ensure that every buffer is NUL-terminated before passing it to the `jv_parse_sized` function.
A flaw was found in jq, a command-line JSON processor. A remote attacker could exploit this vulnerability by providing a specially crafted JSON object. This object leverages a weakness in jq's hashing algorithm, which uses a hardcoded, publicly known seed. By crafting the JSON object to cause hash collisions, an attacker can degrade the performance of JSON object hash table operations, leading to significant CPU exhaustion and a denial of service (DoS) for systems processing the malicious JSON data.
7.5 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/
https://access.redhat.com/errata/RHSA-2026:8579
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
References
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\njq:\n * jq-1.8.1-3.hum1 (aarch64, x86_64)\n * jq-devel-1.8.1-3.hum1 (aarch64, x86_64)\n * jq-1.8.1-3.hum1.src (src)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:8579",
"url": "https://access.redhat.com/errata/RHSA-2026:8579"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40164",
"url": "https://access.redhat.com/security/cve/CVE-2026-40164"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39979",
"url": "https://access.redhat.com/security/cve/CVE-2026-39979"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39956",
"url": "https://access.redhat.com/security/cve/CVE-2026-39956"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33948",
"url": "https://access.redhat.com/security/cve/CVE-2026-33948"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33947",
"url": "https://access.redhat.com/security/cve/CVE-2026-33947"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32316",
"url": "https://access.redhat.com/security/cve/CVE-2026-32316"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8579.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-04-22T16:37:13+00:00",
"generator": {
"date": "2026-04-22T16:37:13+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.5"
}
},
"id": "RHSA-2026:8579",
"initial_release_date": "2026-04-16T20:52:41+00:00",
"revision_history": [
{
"date": "2026-04-16T20:52:41+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-21T22:04:54+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-04-22T16:37:13+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "jq-main@aarch64",
"product": {
"name": "jq-main@aarch64",
"product_id": "jq-main@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jq@1.8.1-3.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "jq-main@src",
"product": {
"name": "jq-main@src",
"product_id": "jq-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jq@1.8.1-3.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "jq-main@x86_64",
"product": {
"name": "jq-main@x86_64",
"product_id": "jq-main@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jq@1.8.1-3.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-main@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:jq-main@aarch64"
},
"product_reference": "jq-main@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:jq-main@src"
},
"product_reference": "jq-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-main@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:jq-main@x86_64"
},
"product_reference": "jq-main@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-32316",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-13T18:01:18.475688+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457929"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jq, a command-line JSON processor. An attacker can exploit an integer overflow vulnerability by crafting queries that produce extremely large strings. This causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, leading to a drastically undersized memory buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap-based buffer overflow. This can result in a Denial of Service (DoS) by crashing the process or potentially allow for further exploitation through heap corruption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jq: jq: Denial of Service or potential arbitrary code execution due to integer overflow and heap-based buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact vulnerability in `jq`, a command-line JSON processor, allows for a Denial of Service or potential arbitrary code execution. The flaw occurs when `jq` processes untrusted queries that generate excessively large strings, leading to an integer overflow and heap-based buffer overflow. Red Hat products that utilize `jq` for processing JSON data are affected if they handle untrusted `jq` queries.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32316"
},
{
"category": "external",
"summary": "RHBZ#2457929",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457929"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32316",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32316"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/commit/e47e56d226519635768e6aab2f38f0ab037c09e5",
"url": "https://github.com/jqlang/jq/commit/e47e56d226519635768e6aab2f38f0ab037c09e5"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/security/advisories/GHSA-q3h9-m34w-h76f",
"url": "https://github.com/jqlang/jq/security/advisories/GHSA-q3h9-m34w-h76f"
}
],
"release_date": "2026-04-13T17:49:34.095000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T20:52:41+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8579"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid processing untrusted or unvalidated JSON input with the `jq` utility. Ensure that any scripts or automated processes utilizing `jq` only operate on trusted data sources. Restricting the execution of `jq` to trusted users and environments can also reduce exposure.",
"product_ids": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jq: jq: Denial of Service or potential arbitrary code execution due to integer overflow and heap-based buffer overflow"
},
{
"cve": "CVE-2026-33947",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"discovery_date": "2026-04-13T22:00:57.898147+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458038"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jq, a command line JSON processor. Processing a crafted JSON document, specifically when a large array is used as a path argument to the `jv_setpath`, `jv_getpath` and `delpaths_sorted` functions can lead to an uncontrolled recursion and exhausts the call stack, causing an application crash and resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jq: unbounded Recursion in jv_setpath() / jv_getpath() / delpaths_sorted()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to supply a crafted JSON input to be processed by jq with the `setpath`, `getpath` or `delpaths` builtins. This allows the attacker to cause an application crash with no other security impact. Due to these reasons, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33947"
},
{
"category": "external",
"summary": "RHBZ#2458038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458038"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33947",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33947"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33947",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33947"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/commit/fb59f1491058d58bdc3e8dd28f1773d1ac690a1f",
"url": "https://github.com/jqlang/jq/commit/fb59f1491058d58bdc3e8dd28f1773d1ac690a1f"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/security/advisories/GHSA-xwrw-4f8h-rjvg",
"url": "https://github.com/jqlang/jq/security/advisories/GHSA-xwrw-4f8h-rjvg"
}
],
"release_date": "2026-04-13T21:50:18.814000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T20:52:41+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8579"
},
{
"category": "workaround",
"details": "Do not process untrusted input with the jq command line JSON processor.",
"product_ids": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jq: unbounded Recursion in jv_setpath() / jv_getpath() / delpaths_sorted()"
},
{
"cve": "CVE-2026-33948",
"cwe": {
"id": "CWE-170",
"name": "Improper Null Termination"
},
"discovery_date": "2026-04-14T00:01:07.744754+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458085"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jq, a command-line JSON processor. This vulnerability allows a remote attacker to bypass input validation by crafting malicious JSON input containing embedded null (NUL) bytes. Due to incorrect handling of input buffer lengths, jq truncates the input at the first NUL byte, validating only the benign prefix and silently discarding any malicious data that follows. This can lead to parser differential attacks where downstream systems, relying on jq for validation, may process the full, unvalidated input, potentially leading to unexpected behavior or security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jq: jq: Input validation bypass via embedded NUL bytes allows parser differential attacks",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33948"
},
{
"category": "external",
"summary": "RHBZ#2458085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458085"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33948",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33948"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33948",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33948"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/commit/6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b",
"url": "https://github.com/jqlang/jq/commit/6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/security/advisories/GHSA-32cx-cvvh-2wj9",
"url": "https://github.com/jqlang/jq/security/advisories/GHSA-32cx-cvvh-2wj9"
}
],
"release_date": "2026-04-13T23:51:04.144000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T20:52:41+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8579"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.8,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "jq: jq: Input validation bypass via embedded NUL bytes allows parser differential attacks"
},
{
"cve": "CVE-2026-39956",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-04-13T23:00:57.627615+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458076"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jq, a command line JSON processor. In release builds, the `_strindices` builtin function calls the `jv_string_indexes` function without checking that the arguments are actually strings. This missing validation allows an attacker who can supply non-string inputs to cause an application crash and a limited memory read.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jq: missing runtime type checks for _strindices lead to crash and limited memory disclosure",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, a user needs to process JSON input with an attacker-supplied argument to the `_strindices` builtin. This allows the attacker to cause an application crash and a limited memory read with no other security impact. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39956"
},
{
"category": "external",
"summary": "RHBZ#2458076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458076"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39956",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39956"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39956",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39956"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/commit/fdf8ef0f0810e3d365cdd5160de43db46f57ed03",
"url": "https://github.com/jqlang/jq/commit/fdf8ef0f0810e3d365cdd5160de43db46f57ed03"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/security/advisories/GHSA-6gc3-3g9p-xx28",
"url": "https://github.com/jqlang/jq/security/advisories/GHSA-6gc3-3g9p-xx28"
}
],
"release_date": "2026-04-13T22:10:18.817000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T20:52:41+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8579"
},
{
"category": "workaround",
"details": "Do not use untrusted input as an argument to a jq builtin, specifically \u0027_strindices\u0027.",
"product_ids": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jq: missing runtime type checks for _strindices lead to crash and limited memory disclosure"
},
{
"cve": "CVE-2026-39979",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-04-13T23:01:01.219840+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458077"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jq, a command line JSON processor, specifically in the libjq API. Parsing a malformed JSON input from a non-NUL-terminated buffer using the `jv_parse_sized` function can cause an out-of-bounds read, resulting in an application crash and a possible memory disclosure within the error message generated by the parser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to supply malformed JSON from a non-NUL-terminated buffer to an application using the `jv_parse_sized` function. This allows the attacker to trigger the out-of-bounds read, causing an application crash and potentially disclosing memory with no other security impact. As this issue affects the libjq library, it is more likely to be exposed to untrusted input. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39979"
},
{
"category": "external",
"summary": "RHBZ#2458077",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458077"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39979",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39979"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39979",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39979"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f",
"url": "https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p",
"url": "https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p"
}
],
"release_date": "2026-04-13T22:18:56.252000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T20:52:41+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8579"
},
{
"category": "workaround",
"details": "To mitigate this issue, manually ensure that every buffer is NUL-terminated before passing it to the `jv_parse_sized` function.",
"product_ids": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers"
},
{
"cve": "CVE-2026-40164",
"cwe": {
"id": "CWE-341",
"name": "Predictable from Observable State"
},
"discovery_date": "2026-04-14T00:01:04.003115+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458084"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jq, a command-line JSON processor. A remote attacker could exploit this vulnerability by providing a specially crafted JSON object. This object leverages a weakness in jq\u0027s hashing algorithm, which uses a hardcoded, publicly known seed. By crafting the JSON object to cause hash collisions, an attacker can degrade the performance of JSON object hash table operations, leading to significant CPU exhaustion and a denial of service (DoS) for systems processing the malicious JSON data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jq: jq: Denial of Service via crafted JSON object causing hash collisions",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40164"
},
{
"category": "external",
"summary": "RHBZ#2458084",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458084"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40164",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40164"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40164",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40164"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/commit/0c7d133c3c7e37c00b6d46b658a02244fdd3c784",
"url": "https://github.com/jqlang/jq/commit/0c7d133c3c7e37c00b6d46b658a02244fdd3c784"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/security/advisories/GHSA-wwj8-gxm6-jc29",
"url": "https://github.com/jqlang/jq/security/advisories/GHSA-wwj8-gxm6-jc29"
}
],
"release_date": "2026-04-13T23:40:12.693000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T20:52:41+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8579"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jq: jq: Denial of Service via crafted JSON object causing hash collisions"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…