SUSE-SU-2026:23873-1
Vulnerability from csaf_suse - Published: 2026-09-17 08:05 - Updated: 2026-09-29 08:20Summary
Security update for jq
Severity
Important
Notes
Title of the patch: Security update for jq
Description of the patch: This update for jq fixes the following issues:
Security issues fixed:
- CVE-2015-8863: heap buffer overflow in tokenadd() function (bsc#976992).
- CVE-2023-50246: improper memory handling can lead to a heap buffer overflow in `decNumberToString` (bsc#1218034).
- CVE-2023-50268: stack-based buffer overflow in builds using decNumber (bsc#1218038).
- CVE-2024-53427: stack-buffer-overflow in the decNumberCopy function in decNumber.c (bsc#1238078).
- CVE-2025-9403: reachable assertion in run_jq_tests() (bsc#1248600).
- CVE-2026-32316: denial of Service or potential arbitrary code execution due to integer overflow and heap-based buffer
overflow (bsc#1262044).
- CVE-2026-33948: CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).
- CVE-2026-40164: predictable hash collisions can lead to a denial of service (bsc#1262072).
- CVE-2026-40612: jv_contains recurses into nested arrays/objects with no depth limit and can cause a stack overflow
(bsc#1265060).
- CVE-2026-41256: embedded NUL truncates top-level jq programs loaded with -f and can lead to execution of unintended
programs (bsc#1265061).
- CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS (bsc#1265062).
- CVE-2026-43894: signed integer overflow in `decNumber` can lead to out-of-bounds memory write (bsc#1265070).
- CVE-2026-43895: embedded NUL bytes in import paths can lead to policy bypass and sensitive information disclosure
(bsc#1265071).
- CVE-2026-43896: unbounded recursion in `jv_object_merge_recursive()` can lead to C stack exhaustion and a process
crash (bsc#1265075).
- CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules `include` each other can lead
to stack exhaustion and process crash (bsc#1265076).
- CVE-2026-47770: stack overflow in deep structural equality (bsc#1269221).
- CVE-2026-49839: `--rawfile` invalid-state reuse after `String too long` can lead to a heap buffer overflow
(bsc#1269220).
- CVE-2026-54679: integer overflow in `jvp_string_append` can lead to a buffer overrun on 32-bit systems (bsc#1269390).
Changes for jq:
Update to version 1.7.1:
* Make the default background color more suitable for bright
backgrounds.
* Allow passing the inline jq script after --.
* Fix possible uninitialised value dereference if jq_init() fails
* Simplify paths/0 and paths/1.
* Reject U+001F in string literals.
* Remove unused nref accumulator in block_bind_library.
* Remove a bunch of unused variables, and useless assignments.
* main.c: Remove unused EXIT_STATUS_EXACT option.
* Actually use the number correctly casted from double to int as
index.
* src/builtin.c: remove unnecessary jv_copy-s in
type_error/type_error2.
* Remove undefined behavior caught by LLVM 10 UBSAN.
* Convert decnum to binary64 (double) instead of decimal64.
This makes jq behave like the JSON specification suggests and
more similar to other languages.
* Fix memory leaks on invalid input for ltrimstr/1 and
rtrimstr/1.
* Fix memory leak on failed get for setpath/2.
* Fix nan from json parsing also for nans with payload that
start with 'n'.
* Allow carriage return characters in comments.
* Generate links in the man page.
* Add extern C for C++.
* Make object key color configurable using JQ_COLORS environment
variable.
* Change the default color of null to Bright Black.
* Respect NO_COLOR environment variable to disable color output.
* Improved --help output. Now mentions all options and nicer
order.
* Fix multiple issues of exit code using --exit-code/-e option.
* Add --raw-output0 for NUL (zero byte) separated output.
* Fix assert crash and validate JSON for --jsonarg.
* Remove deprecated --argfile option.
* Use decimal number literals to preserve precision. Comparison
operations respects precision but arithmetic operations might
truncate.
* Adds new builtin pick(stream) to emit a projection of the
input object or array.
* Adds new builtin debug(msgs) that works like debug but applies
a filter on the input before writing to stderr.
* Adds new builtin scan($re; $flags). Was documented but not
implemented.
* Adds new builtin abs to get absolute value. This potentially
allows the literal value of numbers to be preserved as length
and fabs convert to float.
* Allow if without else-branch. When skipped the else-branch
will be . (identity).
* Allow use of $binding as key in object literals.
* Allow dot between chained indexes when using .["index"]
* Allow dot for chained value iterator .[], .[]?
* Fix try/catch catches more than it should.
* Speed up and refactor some builtins, also remove
scalars_or_empty/0.
* Now halt and halt_error exit immediately instead of continuing
to the next input.
* Fix issue converting string to number after previous convert
error.
* Fix issue representing large numbers on some platforms causing
invalid JSON output.
* Fix deletion using assigning empty against arrays.
* Allow keywords to be used as binding name in more places.
* Allow using nan as NaN in JSON.
* Expose a module's function names in modulemeta.
* Fix contains/1 to handle strings with NUL.
* Fix stderr/0 to output raw text without any decoration.
* Fix nth/2 to emit empty on index out of range.
* Fix implode to not assert and instead replace invalid unicode
codepoints.
* Fix indices/1 and rindex/1 in case of overlapping matches in
strings.
* Fix sub/3 to resolve issues involving global search-and-replace
(gsub) operations.
* Fix empty regular expression matches.
* Fix overflow exception of the modulo operator.
* Fix string multiplication by 0 (and less than 1) to emit empty
string.
* Fix segfault when using libjq and threads.
* Fix constant folding of division and reminder with zero
divisor.
* Fix error/0, error/1 to throw null error.
* Simpler and faster transpose.
* Simple and efficient implementation of walk/1.
* Remove deprecated filters leaf_paths, recurse_down.
Patchnames: SUSE-SLE-Micro-6.0-905,SUSE-SLE-Micro-Extras-6.0-910
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
9.8 (Critical)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.2 (Medium)
Affected products
Recommended
6 products, the same list as for
CVE-2015-8863
Threats
Impact
moderate
6.2 (Medium)
Affected products
Recommended
6 products, the same list as for
CVE-2015-8863
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
6 products, the same list as for
CVE-2015-8863
Threats
Impact
moderate
Affected products
Recommended
6 products, the same list as for
CVE-2015-8863
Threats
Impact
low
6.8 (Medium)
Affected products
Recommended
6 products, the same list as for
CVE-2015-8863
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
6 products, the same list as for
CVE-2015-8863
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
6 products, the same list as for
CVE-2015-8863
Threats
Impact
moderate
6.6 (Medium)
Affected products
Recommended
6 products, the same list as for
CVE-2015-8863
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
6 products, the same list as for
CVE-2015-8863
Threats
Impact
moderate
Affected products
Recommended
6 products, the same list as for
CVE-2015-8863
Threats
Impact
important
7.8 (High)
Affected products
Recommended
6 products, the same list as for
CVE-2015-8863
Threats
Impact
important
4.4 (Medium)
Affected products
Recommended
6 products, the same list as for
CVE-2015-8863
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
6 products, the same list as for
CVE-2015-8863
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
6 products, the same list as for
CVE-2015-8863
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
6 products, the same list as for
CVE-2015-8863
Threats
Impact
moderate
7.1 (High)
Affected products
Recommended
6 products, the same list as for
CVE-2015-8863
Threats
Impact
important
8.1 (High)
Affected products
Recommended
6 products, the same list as for
CVE-2015-8863
Threats
Impact
important
References
79 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for jq",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for jq fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2015-8863: heap buffer overflow in tokenadd() function (bsc#976992).\n- CVE-2023-50246: improper memory handling can lead to a heap buffer overflow in `decNumberToString` (bsc#1218034).\n- CVE-2023-50268: stack-based buffer overflow in builds using decNumber (bsc#1218038).\n- CVE-2024-53427: stack-buffer-overflow in the decNumberCopy function in decNumber.c (bsc#1238078).\n- CVE-2025-9403: reachable assertion in run_jq_tests() (bsc#1248600).\n- CVE-2026-32316: denial of Service or potential arbitrary code execution due to integer overflow and heap-based buffer\n overflow (bsc#1262044).\n- CVE-2026-33948: CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).\n- CVE-2026-40164: predictable hash collisions can lead to a denial of service (bsc#1262072).\n- CVE-2026-40612: jv_contains recurses into nested arrays/objects with no depth limit and can cause a stack overflow\n (bsc#1265060).\n- CVE-2026-41256: embedded NUL truncates top-level jq programs loaded with -f and can lead to execution of unintended\n programs (bsc#1265061).\n- CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS (bsc#1265062).\n- CVE-2026-43894: signed integer overflow in `decNumber` can lead to out-of-bounds memory write (bsc#1265070).\n- CVE-2026-43895: embedded NUL bytes in import paths can lead to policy bypass and sensitive information disclosure\n (bsc#1265071).\n- CVE-2026-43896: unbounded recursion in `jv_object_merge_recursive()` can lead to C stack exhaustion and a process\n crash (bsc#1265075).\n- CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules `include` each other can lead\n to stack exhaustion and process crash (bsc#1265076).\n- CVE-2026-47770: stack overflow in deep structural equality (bsc#1269221).\n- CVE-2026-49839: `--rawfile` invalid-state reuse after `String too long` can lead to a heap buffer overflow\n (bsc#1269220).\n- CVE-2026-54679: integer overflow in `jvp_string_append` can lead to a buffer overrun on 32-bit systems (bsc#1269390).\n\nChanges for jq:\n\nUpdate to version 1.7.1:\n\n * Make the default background color more suitable for bright\n backgrounds.\n * Allow passing the inline jq script after --.\n * Fix possible uninitialised value dereference if jq_init() fails\n * Simplify paths/0 and paths/1.\n * Reject U+001F in string literals.\n * Remove unused nref accumulator in block_bind_library.\n * Remove a bunch of unused variables, and useless assignments.\n * main.c: Remove unused EXIT_STATUS_EXACT option.\n * Actually use the number correctly casted from double to int as\n index.\n * src/builtin.c: remove unnecessary jv_copy-s in\n type_error/type_error2.\n * Remove undefined behavior caught by LLVM 10 UBSAN.\n * Convert decnum to binary64 (double) instead of decimal64.\n This makes jq behave like the JSON specification suggests and\n more similar to other languages.\n * Fix memory leaks on invalid input for ltrimstr/1 and\n rtrimstr/1.\n * Fix memory leak on failed get for setpath/2.\n * Fix nan from json parsing also for nans with payload that\n start with \u0027n\u0027.\n * Allow carriage return characters in comments.\n * Generate links in the man page.\n * Add extern C for C++.\n * Make object key color configurable using JQ_COLORS environment\n variable.\n * Change the default color of null to Bright Black.\n * Respect NO_COLOR environment variable to disable color output.\n * Improved --help output. Now mentions all options and nicer\n order.\n * Fix multiple issues of exit code using --exit-code/-e option.\n * Add --raw-output0 for NUL (zero byte) separated output.\n * Fix assert crash and validate JSON for --jsonarg.\n * Remove deprecated --argfile option.\n * Use decimal number literals to preserve precision. Comparison\n operations respects precision but arithmetic operations might\n truncate.\n * Adds new builtin pick(stream) to emit a projection of the\n input object or array.\n * Adds new builtin debug(msgs) that works like debug but applies\n a filter on the input before writing to stderr.\n * Adds new builtin scan($re; $flags). Was documented but not\n implemented.\n * Adds new builtin abs to get absolute value. This potentially\n allows the literal value of numbers to be preserved as length\n and fabs convert to float.\n * Allow if without else-branch. When skipped the else-branch\n will be . (identity).\n * Allow use of $binding as key in object literals.\n * Allow dot between chained indexes when using .[\"index\"]\n * Allow dot for chained value iterator .[], .[]?\n * Fix try/catch catches more than it should.\n * Speed up and refactor some builtins, also remove\n scalars_or_empty/0.\n * Now halt and halt_error exit immediately instead of continuing\n to the next input.\n * Fix issue converting string to number after previous convert\n error.\n * Fix issue representing large numbers on some platforms causing\n invalid JSON output.\n * Fix deletion using assigning empty against arrays.\n * Allow keywords to be used as binding name in more places.\n * Allow using nan as NaN in JSON.\n * Expose a module\u0027s function names in modulemeta.\n * Fix contains/1 to handle strings with NUL.\n * Fix stderr/0 to output raw text without any decoration.\n * Fix nth/2 to emit empty on index out of range.\n * Fix implode to not assert and instead replace invalid unicode\n codepoints.\n * Fix indices/1 and rindex/1 in case of overlapping matches in\n strings.\n * Fix sub/3 to resolve issues involving global search-and-replace\n (gsub) operations.\n * Fix empty regular expression matches.\n * Fix overflow exception of the modulo operator.\n * Fix string multiplication by 0 (and less than 1) to emit empty\n string.\n * Fix segfault when using libjq and threads.\n * Fix constant folding of division and reminder with zero\n divisor.\n * Fix error/0, error/1 to throw null error.\n * Simpler and faster transpose.\n * Simple and efficient implementation of walk/1.\n * Remove deprecated filters leaf_paths, recurse_down.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.0-905,SUSE-SLE-Micro-Extras-6.0-910",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_23873-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:23873-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202623873-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:23873-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202623873-1/"
},
{
"category": "self",
"summary": "SUSE Bug 1215737",
"url": "https://bugzilla.suse.com/1215737"
},
{
"category": "self",
"summary": "SUSE Bug 1218034",
"url": "https://bugzilla.suse.com/1218034"
},
{
"category": "self",
"summary": "SUSE Bug 1218038",
"url": "https://bugzilla.suse.com/1218038"
},
{
"category": "self",
"summary": "SUSE Bug 1238078",
"url": "https://bugzilla.suse.com/1238078"
},
{
"category": "self",
"summary": "SUSE Bug 1248600",
"url": "https://bugzilla.suse.com/1248600"
},
{
"category": "self",
"summary": "SUSE Bug 1262043",
"url": "https://bugzilla.suse.com/1262043"
},
{
"category": "self",
"summary": "SUSE Bug 1262044",
"url": "https://bugzilla.suse.com/1262044"
},
{
"category": "self",
"summary": "SUSE Bug 1262072",
"url": "https://bugzilla.suse.com/1262072"
},
{
"category": "self",
"summary": "SUSE Bug 1265060",
"url": "https://bugzilla.suse.com/1265060"
},
{
"category": "self",
"summary": "SUSE Bug 1265061",
"url": "https://bugzilla.suse.com/1265061"
},
{
"category": "self",
"summary": "SUSE Bug 1265062",
"url": "https://bugzilla.suse.com/1265062"
},
{
"category": "self",
"summary": "SUSE Bug 1265070",
"url": "https://bugzilla.suse.com/1265070"
},
{
"category": "self",
"summary": "SUSE Bug 1265071",
"url": "https://bugzilla.suse.com/1265071"
},
{
"category": "self",
"summary": "SUSE Bug 1265075",
"url": "https://bugzilla.suse.com/1265075"
},
{
"category": "self",
"summary": "SUSE Bug 1265076",
"url": "https://bugzilla.suse.com/1265076"
},
{
"category": "self",
"summary": "SUSE Bug 1269220",
"url": "https://bugzilla.suse.com/1269220"
},
{
"category": "self",
"summary": "SUSE Bug 1269221",
"url": "https://bugzilla.suse.com/1269221"
},
{
"category": "self",
"summary": "SUSE Bug 1269390",
"url": "https://bugzilla.suse.com/1269390"
},
{
"category": "self",
"summary": "SUSE Bug 976992",
"url": "https://bugzilla.suse.com/976992"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-8863 page",
"url": "https://www.suse.com/security/cve/CVE-2015-8863/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-50246 page",
"url": "https://www.suse.com/security/cve/CVE-2023-50246/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-50268 page",
"url": "https://www.suse.com/security/cve/CVE-2023-50268/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-53427 page",
"url": "https://www.suse.com/security/cve/CVE-2024-53427/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-9403 page",
"url": "https://www.suse.com/security/cve/CVE-2025-9403/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-32316 page",
"url": "https://www.suse.com/security/cve/CVE-2026-32316/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33948 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33948/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-40164 page",
"url": "https://www.suse.com/security/cve/CVE-2026-40164/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-40612 page",
"url": "https://www.suse.com/security/cve/CVE-2026-40612/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41256 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41256/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41257 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41257/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-43894 page",
"url": "https://www.suse.com/security/cve/CVE-2026-43894/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-43895 page",
"url": "https://www.suse.com/security/cve/CVE-2026-43895/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-43896 page",
"url": "https://www.suse.com/security/cve/CVE-2026-43896/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-44777 page",
"url": "https://www.suse.com/security/cve/CVE-2026-44777/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-47770 page",
"url": "https://www.suse.com/security/cve/CVE-2026-47770/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-49839 page",
"url": "https://www.suse.com/security/cve/CVE-2026-49839/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-54679 page",
"url": "https://www.suse.com/security/cve/CVE-2026-54679/"
}
],
"title": "Security update for jq",
"tracking": {
"current_release_date": "2026-09-29T08:20:28Z",
"generator": {
"date": "2026-09-17T08:05:35Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:23873-1",
"initial_release_date": "2026-09-17T08:05:35Z",
"revision_history": [
{
"date": "2026-09-17T08:05:35Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-29T08:20:28Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "jq-0:1.7.1-1.1.aarch64",
"product": {
"name": "jq-0:1.7.1-1.1.aarch64",
"product_id": "jq-0:1.7.1-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:jq_project:jq:1.7.1:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/jq@1.7.1-1.1?arch=aarch64\u0026upstream=jq-0:1.7.1-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libjq1-0:1.7.1-1.1.aarch64",
"product": {
"name": "libjq1-0:1.7.1-1.1.aarch64",
"product_id": "libjq1-0:1.7.1-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:jq_project:jq:1.7.1:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libjq1@1.7.1-1.1?arch=aarch64\u0026upstream=jq-0:1.7.1-1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "jq-0:1.7.1-1.1.s390x",
"product": {
"name": "jq-0:1.7.1-1.1.s390x",
"product_id": "jq-0:1.7.1-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:jq_project:jq:1.7.1:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/jq@1.7.1-1.1?arch=s390x\u0026upstream=jq-0:1.7.1-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libjq1-0:1.7.1-1.1.s390x",
"product": {
"name": "libjq1-0:1.7.1-1.1.s390x",
"product_id": "libjq1-0:1.7.1-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:jq_project:jq:1.7.1:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libjq1@1.7.1-1.1?arch=s390x\u0026upstream=jq-0:1.7.1-1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "jq-0:1.7.1-1.1.x86_64",
"product": {
"name": "jq-0:1.7.1-1.1.x86_64",
"product_id": "jq-0:1.7.1-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:jq_project:jq:1.7.1:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/jq@1.7.1-1.1?arch=x86_64\u0026upstream=jq-0:1.7.1-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "libjq1-0:1.7.1-1.1.x86_64",
"product": {
"name": "libjq1-0:1.7.1-1.1.x86_64",
"product_id": "libjq1-0:1.7.1-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:jq_project:jq:1.7.1:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/libjq1@1.7.1-1.1?arch=x86_64\u0026upstream=jq-0:1.7.1-1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.0",
"product": {
"name": "SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.0"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-0:1.7.1-1.1.aarch64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64"
},
"product_reference": "jq-0:1.7.1-1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-0:1.7.1-1.1.s390x as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x"
},
"product_reference": "jq-0:1.7.1-1.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-0:1.7.1-1.1.x86_64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64"
},
"product_reference": "jq-0:1.7.1-1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq1-0:1.7.1-1.1.aarch64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64"
},
"product_reference": "libjq1-0:1.7.1-1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq1-0:1.7.1-1.1.s390x as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x"
},
"product_reference": "libjq1-0:1.7.1-1.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq1-0:1.7.1-1.1.x86_64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
},
"product_reference": "libjq1-0:1.7.1-1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-8863",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-8863"
}
],
"notes": [
{
"category": "general",
"text": "Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-8863",
"url": "https://www.suse.com/security/cve/CVE-2015-8863"
},
{
"category": "external",
"summary": "SUSE Bug 1014176 for CVE-2015-8863",
"url": "https://bugzilla.suse.com/1014176"
},
{
"category": "external",
"summary": "SUSE Bug 976992 for CVE-2015-8863",
"url": "https://bugzilla.suse.com/976992"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T08:05:35Z",
"details": "moderate"
}
],
"title": "CVE-2015-8863"
},
{
"cve": "CVE-2023-50246",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-50246"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. Version 1.7 is vulnerable to heap-based buffer overflow. Version 1.7.1 contains a patch for this issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-50246",
"url": "https://www.suse.com/security/cve/CVE-2023-50246"
},
{
"category": "external",
"summary": "SUSE Bug 1218034 for CVE-2023-50246",
"url": "https://bugzilla.suse.com/1218034"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T08:05:35Z",
"details": "moderate"
}
],
"title": "CVE-2023-50246"
},
{
"cve": "CVE-2023-50268",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-50268"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. Version 1.7 is vulnerable to stack-based buffer overflow in builds using decNumber. Version 1.7.1 contains a patch for this issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-50268",
"url": "https://www.suse.com/security/cve/CVE-2023-50268"
},
{
"category": "external",
"summary": "SUSE Bug 1218038 for CVE-2023-50268",
"url": "https://bugzilla.suse.com/1218038"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T08:05:35Z",
"details": "moderate"
}
],
"title": "CVE-2023-50268"
},
{
"cve": "CVE-2024-53427",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-53427"
}
],
"notes": [
{
"category": "general",
"text": "decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., \"1 NaN123\" immediately followed by many more digits).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-53427",
"url": "https://www.suse.com/security/cve/CVE-2024-53427"
},
{
"category": "external",
"summary": "SUSE Bug 1238078 for CVE-2024-53427",
"url": "https://bugzilla.suse.com/1238078"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T08:05:35Z",
"details": "moderate"
}
],
"title": "CVE-2024-53427"
},
{
"cve": "CVE-2025-9403",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-9403"
}
],
"notes": [
{
"category": "general",
"text": "A vulnerability was determined in jqlang jq up to 1.6. Impacted is the function run_jq_tests of the file jq_test.c of the component JSON Parser. Executing manipulation can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Other versions might be affected as well.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-9403",
"url": "https://www.suse.com/security/cve/CVE-2025-9403"
},
{
"category": "external",
"summary": "SUSE Bug 1248600 for CVE-2025-9403",
"url": "https://bugzilla.suse.com/1248600"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T08:05:35Z",
"details": "low"
}
],
"title": "CVE-2025-9403"
},
{
"cve": "CVE-2026-32316",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-32316"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-32316",
"url": "https://www.suse.com/security/cve/CVE-2026-32316"
},
{
"category": "external",
"summary": "SUSE Bug 1262044 for CVE-2026-32316",
"url": "https://bugzilla.suse.com/1262044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T08:05:35Z",
"details": "moderate"
}
],
"title": "CVE-2026-32316"
},
{
"cve": "CVE-2026-33948",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33948"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33948",
"url": "https://www.suse.com/security/cve/CVE-2026-33948"
},
{
"category": "external",
"summary": "SUSE Bug 1262043 for CVE-2026-33948",
"url": "https://bugzilla.suse.com/1262043"
},
{
"category": "external",
"summary": "SUSE Bug 1265061 for CVE-2026-33948",
"url": "https://bugzilla.suse.com/1265061"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T08:05:35Z",
"details": "moderate"
}
],
"title": "CVE-2026-33948"
},
{
"cve": "CVE-2026-40164",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-40164"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n), turning any jq expression into an O(n^2) operation and causing significant CPU exhaustion. This affected common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more practical to exploit than existing heap overflow issues since it required only a small payload. This issue has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-40164",
"url": "https://www.suse.com/security/cve/CVE-2026-40164"
},
{
"category": "external",
"summary": "SUSE Bug 1262072 for CVE-2026-40164",
"url": "https://bugzilla.suse.com/1262072"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T08:05:35Z",
"details": "moderate"
}
],
"title": "CVE-2026-40164"
},
{
"cve": "CVE-2026-40612",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-40612"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since the JSON parser caps at depth 10000), the C stack is exhausted.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-40612",
"url": "https://www.suse.com/security/cve/CVE-2026-40612"
},
{
"category": "external",
"summary": "SUSE Bug 1265060 for CVE-2026-40612",
"url": "https://bugzilla.suse.com/1265060"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T08:05:35Z",
"details": "moderate"
}
],
"title": "CVE-2026-40612"
},
{
"cve": "CVE-2026-41256",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41256"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \\x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41256",
"url": "https://www.suse.com/security/cve/CVE-2026-41256"
},
{
"category": "external",
"summary": "SUSE Bug 1265061 for CVE-2026-41256",
"url": "https://bugzilla.suse.com/1265061"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T08:05:35Z",
"details": "moderate"
}
],
"title": "CVE-2026-41256"
},
{
"cve": "CVE-2026-41257",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41257"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM\u0027s data stack tracks its allocation size in a signed int. When the stack grows beyond ~1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41257",
"url": "https://www.suse.com/security/cve/CVE-2026-41257"
},
{
"category": "external",
"summary": "SUSE Bug 1265062 for CVE-2026-41257",
"url": "https://bugzilla.suse.com/1265062"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T08:05:35Z",
"details": "important"
}
],
"title": "CVE-2026-41257"
},
{
"cve": "CVE-2026-43894",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-43894"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack buffer, and then writes ~715 million 16-bit units (~1.4 GiB) at an offset 1.43 GiB below the stack frame. The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-43894",
"url": "https://www.suse.com/security/cve/CVE-2026-43894"
},
{
"category": "external",
"summary": "SUSE Bug 1265070 for CVE-2026-43894",
"url": "https://bugzilla.suse.com/1265070"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T08:05:35Z",
"details": "important"
}
],
"title": "CVE-2026-43894"
},
{
"cve": "CVE-2026-43895",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-43895"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-43895",
"url": "https://www.suse.com/security/cve/CVE-2026-43895"
},
{
"category": "external",
"summary": "SUSE Bug 1265071 for CVE-2026-43895",
"url": "https://bugzilla.suse.com/1265071"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T08:05:35Z",
"details": "moderate"
}
],
"title": "CVE-2026-43895"
},
{
"cve": "CVE-2026-43896",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-43896"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-43896",
"url": "https://www.suse.com/security/cve/CVE-2026-43896"
},
{
"category": "external",
"summary": "SUSE Bug 1265075 for CVE-2026-43896",
"url": "https://bugzilla.suse.com/1265075"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T08:05:35Z",
"details": "moderate"
}
],
"title": "CVE-2026-43896"
},
{
"cve": "CVE-2026-44777",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-44777"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two\notherwise valid modules include each other.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-44777",
"url": "https://www.suse.com/security/cve/CVE-2026-44777"
},
{
"category": "external",
"summary": "SUSE Bug 1265076 for CVE-2026-44777",
"url": "https://bugzilla.suse.com/1265076"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T08:05:35Z",
"details": "moderate"
}
],
"title": "CVE-2026-44777"
},
{
"cve": "CVE-2026-47770",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-47770"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq\u0027s ordinary command-line surface, resulting in denial of service via stack exhaustion (uncontrolled recursion). The crash occurs in jq\u0027s recursive structural comparison code, with the recursion repeating through jvp_array_equal() and jv_equal() in src/jv.c when comparing deeply nested arrays; a nearby sort comparator path through jv_cmp() in src/jv_aux.c overflows the stack at a larger nesting depth from the same missing recursion guard. Anyone running jq comparisons on attacker-controlled deeply nested JSON values, or embedding jq in a context where untrusted data can reach the == comparison path, is affected. This vulnerability is fixed in 1.8.2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-47770",
"url": "https://www.suse.com/security/cve/CVE-2026-47770"
},
{
"category": "external",
"summary": "SUSE Bug 1269221 for CVE-2026-47770",
"url": "https://bugzilla.suse.com/1269221"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T08:05:35Z",
"details": "moderate"
}
],
"title": "CVE-2026-47770"
},
{
"cve": "CVE-2026-49839",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-49839"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds. When jv_load_file(raw=1) reads an attacker-controlled file, it repeatedly appends file chunks to the same jv string accumulator. Once jv_string_append_buf() returns jv_invalid_with_msg(\"String too long\"), the raw-file loop does not stop. If the file contains at least one more byte, the next loop iteration appends a new chunk to an object that is already invalid. With assertions enabled this aborts in jvp_string_ptr(). With assertions disabled, the invalid object is interpreted as a string object and ASan reports heap-buffer-overflow. This vulnerability is fixed in 1.8.2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-49839",
"url": "https://www.suse.com/security/cve/CVE-2026-49839"
},
{
"category": "external",
"summary": "SUSE Bug 1269220 for CVE-2026-49839",
"url": "https://bugzilla.suse.com/1269220"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T08:05:35Z",
"details": "important"
}
],
"title": "CVE-2026-49839"
},
{
"cve": "CVE-2026-54679",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-54679"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvp_string_append has a chance of integer/multiple overflowing and then causing a massive buffer overrun. This vulnerability is fixed in 1.8.2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-54679",
"url": "https://www.suse.com/security/cve/CVE-2026-54679"
},
{
"category": "external",
"summary": "SUSE Bug 1269390 for CVE-2026-54679",
"url": "https://bugzilla.suse.com/1269390"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:jq-0:1.7.1-1.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libjq1-0:1.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-17T08:05:35Z",
"details": "important"
}
],
"title": "CVE-2026-54679"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…