Описание
Security update for jq
This update for jq fixes the following issues
- CVE-2026-43896: unbounded recursion in jv_object_merge_recursive() can lead to C stack exhaustion and a process crash (bsc#1265075).
- CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules
includeeach other can lead to stack exhaustion and process crash (bsc#1265076). - CVE-2026-49839: fixed a bug where jq --rawfile can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds (bsc#1269220).
- CVE-2026-54679: integer overflow in jvp_string_append can lead to a buffer overrun on 32-bit systems (bsc#1269390).
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1265075
- SUSE Bug 1265076
- SUSE Bug 1269220
- SUSE Bug 1269390
- SUSE CVE CVE-2026-43896 page
- SUSE CVE CVE-2026-44777 page
- SUSE CVE CVE-2026-49839 page
- SUSE CVE CVE-2026-54679 page
Описание
jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects.
Затронутые продукты
Ссылки
- CVE-2026-43896
- SUSE Bug 1265075
Описание
jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two otherwise valid modules include each other.
Затронутые продукты
Ссылки
- CVE-2026-44777
- SUSE Bug 1265076
Описание
jq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds. When jv_load_file(raw=1) reads an attacker-controlled file, it repeatedly appends file chunks to the same jv string accumulator. Once jv_string_append_buf() returns jv_invalid_with_msg("String too long"), the raw-file loop does not stop. If the file contains at least one more byte, the next loop iteration appends a new chunk to an object that is already invalid. With assertions enabled this aborts in jvp_string_ptr(). With assertions disabled, the invalid object is interpreted as a string object and ASan reports heap-buffer-overflow. This vulnerability is fixed in 1.8.2.
Затронутые продукты
Ссылки
- CVE-2026-49839
- SUSE Bug 1269220
Описание
jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvp_string_append has a chance of integer/multiple overflowing and then causing a massive buffer overrun. This vulnerability is fixed in 1.8.2.
Затронутые продукты
Ссылки
- CVE-2026-54679
- SUSE Bug 1269390