{ "document": { "aggregate_severity": { "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2026-33948: fix NUL truncation in JSON parser (validation bypass)\n- CVE-2026-33947: fix unbounded recursion in jv_setpath/jv_getpath/delpaths\n- CVE-2026-40612: limit containment check depth\n- CVE-2026-41256: fix NUL truncation in program files loaded with -f\n- CVE-2026-41257: fix signed-int overflow in stack_reallocate\n- CVE-2026-43894: cap numeric literal length to DEC_MAX_DIGITS\n- CVE-2026-43895: reject embedded NUL bytes in module import paths\n- CVE-2026-43896: limit recursive object merge depth\n- CVE-2026-44777: detect circular module imports\n- CVE-2026-47770: guard deep structural equality and comparison recursion\n- CVE-2024-53427: reject NaN with payload in jvp_literal_number_new()\n- CVE-2025-9403: replace reparse assertion in run_jq_tests() with a test failure", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791534444", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791534444" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/tuxcare9.8esu/advisories/2026/clsa-2026_1791534444.json" } ], "tracking": { "current_release_date": "2026-10-09T08:29:10Z", "generator": { "date": "2026-10-09T08:29:10Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1791534444", "initial_release_date": "2026-10-09T08:29:10Z", "revision_history": [ { "date": "2026-10-09T08:29:10Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "jq: Fix of 12 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "AlmaLinux 9.8", "product": { "name": "AlmaLinux 9.8", "product_id": "AlmaLinux-9.8", "product_identification_helper": { "cpe": "cpe:2.3:o:almalinux:almalinux:9.8:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "AlmaLinux" } ], "category": "vendor", "name": "AlmaLinux OS Foundation" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "Rocky Linux 9.8", "product": { "name": "Rocky Linux 9.8", "product_id": "Rocky Linux-9.8", "product_identification_helper": { "cpe": "cpe:2.3:o:resf:rocky_linux:9.8:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Rocky Linux" } ], "category": "vendor", "name": "Rocky Linux" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "product": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "product_id": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/jq-devel@1.6-19.el9_8.2.tuxcare.els3?arch=x86_64" } } }, { "category": "product_version", "name": "jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "product": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "product_id": "jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/jq@1.6-19.el9_8.2.tuxcare.els3?arch=x86_64" } } }, { "category": "product_version", "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "product": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "product_id": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/jq-devel@1.6-19.el9_8.2.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "product": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "product_id": "jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/jq@1.6-19.el9_8.2.tuxcare.els2?arch=x86_64" } } }, { "category": "product_version", "name": "jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "product": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "product_id": "jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/jq@1.6-19.el9_8.2.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "product": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "product_id": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/jq-devel@1.6-19.el9_8.2.tuxcare.els1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "product": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "product_id": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/jq-devel@1.6-19.el9_8.2.tuxcare.els3?arch=aarch64" } } }, { "category": "product_version", "name": "jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "product": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "product_id": "jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/jq@1.6-19.el9_8.2.tuxcare.els3?arch=aarch64" } } }, { "category": "product_version", "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "product": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "product_id": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/jq-devel@1.6-19.el9_8.2.tuxcare.els2?arch=aarch64" } } }, { "category": "product_version", "name": "jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "product": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "product_id": "jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/jq@1.6-19.el9_8.2.tuxcare.els2?arch=aarch64" } } }, { "category": "product_version", "name": "jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "product": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "product_id": "jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/jq@1.6-19.el9_8.2.tuxcare.els1?arch=aarch64" } } }, { "category": "product_version", "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "product": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "product_id": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/jq-devel@1.6-19.el9_8.2.tuxcare.els1?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "product": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "product_id": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/jq-devel@1.6-19.el9_8.2.tuxcare.els3?arch=i686" } } }, { "category": "product_version", "name": "jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "product": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "product_id": "jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/jq@1.6-19.el9_8.2.tuxcare.els3?arch=i686" } } }, { "category": "product_version", "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "product": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "product_id": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/jq-devel@1.6-19.el9_8.2.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "product": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "product_id": "jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/jq@1.6-19.el9_8.2.tuxcare.els2?arch=i686" } } }, { "category": "product_version", "name": "jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "product": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "product_id": "jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/jq@1.6-19.el9_8.2.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "product": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "product_id": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/jq-devel@1.6-19.el9_8.2.tuxcare.els1?arch=i686" } } } ], "category": "architecture", "name": "i686" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" }, "product_reference": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64" }, "product_reference": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686" }, "product_reference": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" }, "product_reference": "jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64" }, "product_reference": "jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els3.i686 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686" }, "product_reference": "jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" }, "product_reference": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64" }, "product_reference": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686" }, "product_reference": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" }, "product_reference": "jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64" }, "product_reference": "jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els3.i686 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686" }, "product_reference": "jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" }, "product_reference": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64" }, "product_reference": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686" }, "product_reference": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els2.i686 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686" }, "product_reference": "jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64" }, "product_reference": "jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" }, "product_reference": "jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" }, "product_reference": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64" }, "product_reference": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686" }, "product_reference": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els2.i686 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686" }, "product_reference": "jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64" }, "product_reference": "jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" }, "product_reference": "jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els1.i686 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686" }, "product_reference": "jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64" }, "product_reference": "jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64" }, "product_reference": "jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64" }, "product_reference": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686" }, "product_reference": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64" }, "product_reference": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els1.i686 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686" }, "product_reference": "jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64" }, "product_reference": "jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64" }, "product_reference": "jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64" }, "product_reference": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686" }, "product_reference": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64" }, "product_reference": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "relates_to_product_reference": "Rocky Linux-9.8" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-43894", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack buffer, and then writes ≈715 million 16-bit units (≈1.4 GiB) at an offset 1.43 GiB below the stack frame. The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" ], "known_affected": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-43894" }, { "category": "external", "summary": "https://github.com/jqlang/jq/security/advisories/GHSA-5v7p-2r57-2g4g", "url": "https://github.com/jqlang/jq/security/advisories/GHSA-5v7p-2r57-2g4g" } ], "release_date": "2026-05-11T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-09T08:27:25.613100Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791534444", "product_ids": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791534444" }, { "category": "none_available", "date": "2026-05-11T18:16:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-41256", "cwe": { "id": "CWE-158", "name": "Improper Neutralization of Null Byte or NUL Character" }, "notes": [ { "category": "description", "text": "jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \\x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" ], "known_affected": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-41256" }, { "category": "external", "summary": "https://github.com/jqlang/jq/security/advisories/GHSA-vf2h-chrj-q3fg", "url": "https://github.com/jqlang/jq/security/advisories/GHSA-vf2h-chrj-q3fg" } ], "release_date": "2026-05-11T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-09T08:27:25.613100Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791534444", "product_ids": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791534444" }, { "category": "none_available", "date": "2026-05-11T18:16:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-47770", "cwe": { "id": "CWE-674", "name": "Uncontrolled Recursion" }, "notes": [ { "category": "description", "text": "jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion (uncontrolled recursion). The crash occurs in jq's recursive structural comparison code, with the recursion repeating through jvp_array_equal() and jv_equal() in src/jv.c when comparing deeply nested arrays; a nearby sort comparator path through jv_cmp() in src/jv_aux.c overflows the stack at a larger nesting depth from the same missing recursion guard. Anyone running jq comparisons on attacker-controlled deeply nested JSON values, or embedding jq in a context where untrusted data can reach the == comparison path, is affected. This vulnerability is fixed in 1.8.2.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" ], "known_affected": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-47770" }, { "category": "external", "summary": "https://github.com/jqlang/jq/security/advisories/GHSA-3pgx-frr7-3jxp", "url": "https://github.com/jqlang/jq/security/advisories/GHSA-3pgx-frr7-3jxp" } ], "release_date": "2026-06-25T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-09T08:27:25.613100Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791534444", "product_ids": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791534444" }, { "category": "none_available", "date": "2026-06-25T18:16:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-33947", "cwe": { "id": "CWE-674", "name": "Uncontrolled Recursion" }, "notes": [ { "category": "description", "text": "jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(), and delpaths_sorted() in jq's src/jv_aux.c use unbounded recursion whose depth is controlled by the length of a caller-supplied path array, with no depth limit enforced. An attacker can supply a JSON document containing a flat array of ~65,000 integers (~200 KB) that, when used as a path argument by a trusted jq filter, exhausts the C call stack and crashes the process with a segmentation fault (SIGSEGV). This bypass works because the existing MAX_PARSING_DEPTH (10,000) limit only protects the JSON parser, not runtime path operations where arrays can be programmatically constructed to arbitrary lengths. The impact is denial of service (unrecoverable crash) affecting any application or service that processes untrusted JSON input through jq's setpath, getpath, or delpaths builtins. This issue has been addressed in commit fb59f1491058d58bdc3e8dd28f1773d1ac690a1f.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" ], "known_affected": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-33947" }, { "category": "external", "summary": "https://github.com/jqlang/jq/commit/fb59f1491058d58bdc3e8dd28f1773d1ac690a1f", "url": "https://github.com/jqlang/jq/commit/fb59f1491058d58bdc3e8dd28f1773d1ac690a1f" }, { "category": "external", "summary": "https://github.com/jqlang/jq/security/advisories/GHSA-xwrw-4f8h-rjvg", "url": "https://github.com/jqlang/jq/security/advisories/GHSA-xwrw-4f8h-rjvg" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/04/16/1", "url": "http://www.openwall.com/lists/oss-security/2026/04/16/1" } ], "release_date": "2026-04-13T22:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-09T08:27:25.613100Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791534444", "product_ids": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791534444" }, { "category": "none_available", "date": "2026-04-13T22:16:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-43896", "cwe": { "id": "CWE-674", "name": "Uncontrolled Recursion" }, "notes": [ { "category": "description", "text": "jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" ], "known_affected": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-43896" }, { "category": "external", "summary": "https://github.com/jqlang/jq/security/advisories/GHSA-mg96-6h3q-g846", "url": "https://github.com/jqlang/jq/security/advisories/GHSA-mg96-6h3q-g846" } ], "release_date": "2026-05-11T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-09T08:27:25.613100Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791534444", "product_ids": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791534444" }, { "category": "none_available", "date": "2026-05-11T18:16:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-43895", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "description", "text": "jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" ], "known_affected": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-43895" }, { "category": "external", "summary": "https://github.com/jqlang/jq/security/advisories/GHSA-7q7g-mrq3-phxr", "url": "https://github.com/jqlang/jq/security/advisories/GHSA-7q7g-mrq3-phxr" } ], "release_date": "2026-05-11T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-09T08:27:25.613100Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791534444", "product_ids": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791534444" }, { "category": "none_available", "date": "2026-05-11T18:16:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2024-53427", "cwe": { "id": "CWE-843", "name": "Access of Resource Using Incompatible Type ('Type Confusion')" }, "notes": [ { "category": "description", "text": "decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., \"1 NaN123\" immediately followed by many more digits).", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" ], "known_affected": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-53427" }, { "category": "external", "summary": "https://gist.github.com/Ekkosun/a83870ce7f3b7813b9b462a395e8ad92", "url": "https://gist.github.com/Ekkosun/a83870ce7f3b7813b9b462a395e8ad92" }, { "category": "external", "summary": "https://github.com/jqlang/jq/blob/71c2ab509a8628dbbad4bc7b3f98a64aa90d3297/src/decNumber/decNumber.c#L3375", "url": "https://github.com/jqlang/jq/blob/71c2ab509a8628dbbad4bc7b3f98a64aa90d3297/src/decNumber/decNumber.c#L3375" }, { "category": "external", "summary": "https://github.com/jqlang/jq/issues/3196", "url": "https://github.com/jqlang/jq/issues/3196" }, { "category": "external", "summary": "https://github.com/jqlang/jq/issues/3296", "url": "https://github.com/jqlang/jq/issues/3296" }, { "category": "external", "summary": "https://github.com/jqlang/jq/security/advisories/GHSA-x6c3-qv5r-7q22", "url": "https://github.com/jqlang/jq/security/advisories/GHSA-x6c3-qv5r-7q22" } ], "release_date": "2025-02-26T16:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-09T08:27:25.613100Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791534444", "product_ids": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791534444" }, { "category": "none_available", "date": "2025-02-26T16:15:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-44777", "cwe": { "id": "CWE-674", "name": "Uncontrolled Recursion" }, "notes": [ { "category": "description", "text": "jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two\notherwise valid modules include each other.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" ], "known_affected": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-44777" }, { "category": "external", "summary": "https://github.com/jqlang/jq/security/advisories/GHSA-rmpv-jgvr-wpr9", "url": "https://github.com/jqlang/jq/security/advisories/GHSA-rmpv-jgvr-wpr9" } ], "release_date": "2026-05-11T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-09T08:27:25.613100Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791534444", "product_ids": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791534444" }, { "category": "none_available", "date": "2026-05-11T18:16:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-33948", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "description", "text": "jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" ], "known_affected": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-33948" }, { "category": "external", "summary": "https://github.com/jqlang/jq/commit/6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b", "url": "https://github.com/jqlang/jq/commit/6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b" }, { "category": "external", "summary": "https://github.com/jqlang/jq/security/advisories/GHSA-32cx-cvvh-2wj9", "url": "https://github.com/jqlang/jq/security/advisories/GHSA-32cx-cvvh-2wj9" } ], "release_date": "2026-04-14T00:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-09T08:27:25.613100Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791534444", "product_ids": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791534444" }, { "category": "none_available", "date": "2026-04-14T00:16:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-40612", "cwe": { "id": "CWE-674", "name": "Uncontrolled Recursion" }, "notes": [ { "category": "description", "text": "jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since the JSON parser caps at depth 10000), the C stack is exhausted.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" ], "known_affected": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-40612" }, { "category": "external", "summary": "https://github.com/jqlang/jq/security/advisories/GHSA-r7m6-x9c7-h69j", "url": "https://github.com/jqlang/jq/security/advisories/GHSA-r7m6-x9c7-h69j" } ], "release_date": "2026-05-11T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-09T08:27:25.613100Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791534444", "product_ids": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791534444" }, { "category": "none_available", "date": "2026-05-11T18:16:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-41257", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" ], "known_affected": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-41257" }, { "category": "external", "summary": "https://github.com/jqlang/jq/security/advisories/GHSA-4jm8-m363-4539", "url": "https://github.com/jqlang/jq/security/advisories/GHSA-4jm8-m363-4539" } ], "release_date": "2026-05-11T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-09T08:27:25.613100Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791534444", "product_ids": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791534444" }, { "category": "none_available", "date": "2026-05-11T18:16:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2025-9403", "cwe": { "id": "CWE-617", "name": "Reachable Assertion" }, "notes": [ { "category": "description", "text": "A vulnerability was determined in jqlang jq up to 1.6. Impacted is the function run_jq_tests of the file jq_test.c of the component JSON Parser. Executing manipulation can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Other versions might be affected as well.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" ], "known_affected": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-9403" }, { "category": "external", "summary": "https://drive.google.com/file/d/1r8m9PhU_rk-QPj6OMcs415FcvWPD-zJY/view?usp=sharing", "url": "https://drive.google.com/file/d/1r8m9PhU_rk-QPj6OMcs415FcvWPD-zJY/view?usp=sharing" }, { "category": "external", "summary": "https://github.com/jqlang/jq/issues/3393", "url": "https://github.com/jqlang/jq/issues/3393" }, { "category": "external", "summary": "https://vuldb.com/?ctiid.321239", "url": "https://vuldb.com/?ctiid.321239" }, { "category": "external", "summary": "https://vuldb.com/?id.321239", "url": "https://vuldb.com/?id.321239" }, { "category": "external", "summary": "https://vuldb.com/?submit.633170", "url": "https://vuldb.com/?submit.633170" } ], "release_date": "2025-08-25T03:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-09T08:27:25.613100Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791534444", "product_ids": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els3.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791534444" }, { "category": "none_available", "date": "2025-08-25T03:15:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els2.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.aarch64", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.i686", "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }