Описание
Security update for jq
This update for jq fixes the following issues:
- CVE-2026-32316: integer overflow within the
jvp_string_append()andjvp_string_copy_replace_badfunctions can lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044). - CVE-2026-33947: unbounded recursion in functions
jv_setpath(),jv_getpath(), anddelpaths_sorted()can lead to excessive resource consumption when processing crafted JSON input (bsc#1262069). - CVE-2026-39956: missing runtime type checks in
_strindicesandjv_string_indexes()can lead to a crash when evaluating untrusted jq filters against a release build (bsc#1262070). - CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in
jv_parse_sizedcan lead to an out-of-bounds read when processing malformed JSON (bsc#1262071). - CVE-2026-40164: use of
MurmurHash3with a hardcoded seed allows pre-computation of key collisions and can lead to a denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).
Список пакетов
Container suse/sle-micro-rancher/5.3:latest
Container suse/sle-micro-rancher/5.4:latest
Container suse/sle-micro/5.5:latest
Container third-party/nvidia/driver:550-sles15.7
Container third-party/nvidia/driver:570-sles15.7
Container third-party/nvidia/driver:575-sles15.7
Container third-party/nvidia/driver:580-sles15.7
Container third-party/nvidia/driver:590-sles15.7
Container third-party/nvidia/driver:595-sles15.7
SUSE Linux Enterprise Micro 5.3
SUSE Linux Enterprise Micro 5.4
SUSE Linux Enterprise Micro 5.5
SUSE Linux Enterprise Module for Basesystem 15 SP7
Ссылки
- Link for SUSE-SU-2026:2983-1
- E-Mail link for SUSE-SU-2026:2983-1
- SUSE Security Ratings
- SUSE Bug 1262044
- SUSE Bug 1262069
- SUSE Bug 1262070
- SUSE Bug 1262071
- SUSE Bug 1262072
- SUSE CVE CVE-2026-32316 page
- SUSE CVE CVE-2026-33947 page
- SUSE CVE CVE-2026-39956 page
- SUSE CVE CVE-2026-39979 page
- SUSE CVE CVE-2026-40164 page
Описание
jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5.
Затронутые продукты
Ссылки
- CVE-2026-32316
- SUSE Bug 1262044
Описание
jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(), and delpaths_sorted() in jq's src/jv_aux.c use unbounded recursion whose depth is controlled by the length of a caller-supplied path array, with no depth limit enforced. An attacker can supply a JSON document containing a flat array of ~65,000 integers (~200 KB) that, when used as a path argument by a trusted jq filter, exhausts the C call stack and crashes the process with a segmentation fault (SIGSEGV). This bypass works because the existing MAX_PARSING_DEPTH (10,000) limit only protects the JSON parser, not runtime path operations where arrays can be programmatically constructed to arbitrary lengths. The impact is denial of service (unrecoverable crash) affecting any application or service that processes untrusted JSON input through jq's setpath, getpath, or delpaths builtins. This issue has been addressed in commit fb59f1491058d58bdc3e8dd28f1773d1ac690a1f.
Затронутые продукты
Ссылки
- CVE-2026-33947
- SUSE Bug 1262069
Описание
jq is a command-line JSON processor. In commits after 69785bf77f86e2ea1b4a20ca86775916889e91c9, the _strindices builtin in jq's src/builtin.c passes its arguments directly to jv_string_indexes() without verifying they are strings, and jv_string_indexes() in src/jv.c relies solely on assert() checks that are stripped in release builds compiled with -DNDEBUG. This allows an attacker to crash jq trivially with input like _strindices(0), and by crafting a numeric value whose IEEE-754 bit pattern maps to a chosen pointer, achieve a controlled pointer dereference and limited memory read/probe primitive. Any deployment that evaluates untrusted jq filters against a release build is vulnerable. This issue has been patched in commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03.
Затронутые продукты
Ссылки
- CVE-2026-39956
- SUSE Bug 1262070
Описание
jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.
Затронутые продукты
Ссылки
- CVE-2026-39979
- SUSE Bug 1262071
Описание
jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n), turning any jq expression into an O(n²) operation and causing significant CPU exhaustion. This affected common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more practical to exploit than existing heap overflow issues since it required only a small payload. This issue has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784.
Затронутые продукты
Ссылки
- CVE-2026-40164
- SUSE Bug 1262072