Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-39979 (GCVE-0-2026-39979)
Vulnerability from cvelistv5 – Published: 2026-04-13 22:18 – Updated: 2026-07-15 01:01
VLAI
EPSS
VEX
Title
jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers
Summary
jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-14 13:43 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
32 references
Impacted products
32 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| jqlang | jq |
Affected:
< 2f09060afab23fe9390cce7cb860b10416e1bf5f
|
guessed | |
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
0:1.7.1-11.el10_1.0.2 , < *
(rpm)
Unaffected: 0:1.7.1-11.el10_2.2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.1 cpe:/o:redhat:enterprise_linux:10.2 |
||
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support |
Unaffected:
0:1.7.1-8.el10_0.3 , < *
(rpm)
cpe:/o:redhat:enterprise_linux_eus:10.0 |
||
| Red Hat | Red Hat Enterprise Linux 8 |
Unaffected:
0:1.6-12.el8_10 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:8 |
||
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support |
Unaffected:
0:1.5-12.el8_4.5 , < *
(rpm)
cpe:/a:redhat:rhel_aus:8.4 |
||
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On |
Unaffected:
0:1.5-12.el8_4.5 , < *
(rpm)
cpe:/a:redhat:rhel_eus_long_life:8.4 |
||
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support |
Unaffected:
0:1.6-3.el8_6.2 , < *
(rpm)
cpe:/a:redhat:rhel_aus:8.6 |
||
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service |
Unaffected:
0:1.6-3.el8_6.2 , < *
(rpm)
cpe:/a:redhat:rhel_tus:8.6 |
||
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions |
Unaffected:
0:1.6-3.el8_6.2 , < *
(rpm)
cpe:/a:redhat:rhel_e4s:8.6 |
||
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service |
Unaffected:
0:1.6-6.el8_8.4 , < *
(rpm)
cpe:/a:redhat:rhel_tus:8.8 |
||
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions |
Unaffected:
0:1.6-6.el8_8.4 , < *
(rpm)
cpe:/a:redhat:rhel_e4s:8.8 |
||
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
0:1.6-19.el9_7.0.2 , < *
(rpm)
Unaffected: 0:1.6-19.el9_8.2 , < * (rpm) cpe:/o:redhat:enterprise_linux:9 |
||
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions |
Unaffected:
0:1.6-12.el9_0.3 , < *
(rpm)
cpe:/a:redhat:rhel_e4s:9.0 |
||
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions |
Unaffected:
0:1.6-15.el9_2.3 , < *
(rpm)
cpe:/a:redhat:rhel_e4s:9.2 |
||
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support |
Unaffected:
0:1.6-16.el9_4.2 , < *
(rpm)
cpe:/o:redhat:rhel_eus:9.4 |
||
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support |
Unaffected:
0:1.6-17.el9_6.4 , < *
(rpm)
cpe:/o:redhat:rhel_eus:9.6 |
||
| Red Hat | Red Hat OpenShift Container Platform 4.12 |
Unaffected:
412.86.202606140301-0 , < *
(rpm)
cpe:/a:redhat:openshift:4.12::el8 |
||
| Red Hat | Red Hat OpenShift Container Platform 4.13 |
Unaffected:
413.92.202606160406-0 , < *
(rpm)
cpe:/a:redhat:openshift:4.13::el9 |
||
| Red Hat | Red Hat OpenShift Container Platform 4.14 |
Unaffected:
414.92.202606231112-0 , < *
(rpm)
cpe:/a:redhat:openshift:4.14::el9 |
||
| Red Hat | Red Hat OpenShift Container Platform 4.15 |
Unaffected:
415.92.202606030318-0 , < *
(rpm)
cpe:/a:redhat:openshift:4.15::el9 |
||
| Red Hat | Red Hat OpenShift Container Platform 4.16 |
Unaffected:
416.94.202606051757-0 , < *
(rpm)
cpe:/a:redhat:openshift:4.16::el9 |
||
| Red Hat | Red Hat OpenShift Container Platform 4.17 |
Unaffected:
417.94.202606250942-0 , < *
(rpm)
cpe:/a:redhat:openshift:4.17::el9 |
||
| Red Hat | Red Hat OpenShift Container Platform 4.18 |
Unaffected:
418.94.202606051320-0 , < *
(rpm)
cpe:/a:redhat:openshift:4.18::el9 |
||
| Red Hat | Red Hat OpenShift Container Platform 4.19 |
Unaffected:
4.19.9.6.202606031700-0 , < *
(rpm)
cpe:/a:redhat:openshift:4.19::el9 |
||
| Red Hat | Red Hat AI Inference Server 3.2 |
Unaffected:
1780681984 , < *
(rpm)
cpe:/a:redhat:ai_inference_server:3.2::el9 |
||
| Red Hat | Red Hat AI Inference Server 3.3 |
Unaffected:
1782352950 , < *
(rpm)
cpe:/a:redhat:ai_inference_server:3.3::el9 |
||
| Red Hat | Red Hat AI Inference Server 3.3 |
Unaffected:
1782352919 , < *
(rpm)
cpe:/a:redhat:ai_inference_server:3.3::el9 |
||
| Red Hat | Red Hat AI Inference Server 3.3 |
Unaffected:
1782353093 , < *
(rpm)
cpe:/a:redhat:ai_inference_server:3.3::el9 |
||
| Red Hat | Red Hat AI Inference Server 3.3 |
Unaffected:
1782352847 , < *
(rpm)
cpe:/a:redhat:ai_inference_server:3.3::el9 |
||
| Red Hat | Red Hat Hardened Images |
Unaffected:
1.8.1-3.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
||
| Red Hat | Red Hat Ansible Automation Platform 2 |
cpe:/a:redhat:ansible_automation_platform:2
|
||
| Red Hat | Red Hat Ceph Storage 4 |
cpe:/a:redhat:ceph_storage:4
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-39979",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-14T13:43:11.607182Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-14T13:43:15.227Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.1",
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "jq",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.7.1-11.el10_1.0.2",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.7.1-11.el10_2.2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "jq",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.7.1-8.el10_0.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "jq",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.6-12.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4"
],
"defaultStatus": "affected",
"packageName": "jq",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.5-12.el8_4.5",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus_long_life:8.4"
],
"defaultStatus": "affected",
"packageName": "jq",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.5-12.el8_4.5",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6"
],
"defaultStatus": "affected",
"packageName": "jq",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.6-3.el8_6.2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_tus:8.6"
],
"defaultStatus": "affected",
"packageName": "jq",
"product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.6-3.el8_6.2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.6"
],
"defaultStatus": "affected",
"packageName": "jq",
"product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.6-3.el8_6.2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_tus:8.8"
],
"defaultStatus": "affected",
"packageName": "jq",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.6-6.el8_8.4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8"
],
"defaultStatus": "affected",
"packageName": "jq",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.6-6.el8_8.4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "jq",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.6-19.el9_7.0.2",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.6-19.el9_8.2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.0"
],
"defaultStatus": "affected",
"packageName": "jq",
"product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.6-12.el9_0.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"defaultStatus": "affected",
"packageName": "jq",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.6-15.el9_2.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus:9.4"
],
"defaultStatus": "affected",
"packageName": "jq",
"product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.6-16.el9_4.2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "jq",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.6-17.el9_6.4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.12::el8"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.12",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "412.86.202606140301-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.13::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.13",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "413.92.202606160406-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.14::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.14",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "414.92.202606231112-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.15::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.15",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "415.92.202606030318-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.16::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.16",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "416.94.202606051757-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.17::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.17",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "417.94.202606250942-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.18::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.18",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "418.94.202606051320-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.19::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.19",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.19.9.6.202606031700-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.2::el9"
],
"defaultStatus": "affected",
"packageName": "rhaiis/model-opt-cuda-rhel9",
"product": "Red Hat AI Inference Server 3.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780681984",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhaiis/model-opt-cuda-rhel9",
"product": "Red Hat AI Inference Server 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782352950",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-spyre-rhel9",
"product": "Red Hat AI Inference Server 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782352919",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-rocm-rhel9",
"product": "Red Hat AI Inference Server 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782353093",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-cuda-rhel9",
"product": "Red Hat AI Inference Server 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782352847",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "jq-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1.8.1-3.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/controller-rhel9",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "ansible-automation-platform-26/hub-rhel9",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "automation-controller",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ceph_storage:4"
],
"defaultStatus": "affected",
"packageName": "jq",
"product": "Red Hat Ceph Storage 4",
"vendor": "Red Hat"
}
],
"datePublic": "2026-04-13T22:18:56.252Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in jq, a command line JSON processor, specifically in the libjq API. Parsing a malformed JSON input from a non-NUL-terminated buffer using the `jv_parse_sized` function can cause an out-of-bounds read, resulting in an application crash and a possible memory disclosure within the error message generated by the parser."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T01:01:40.651Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-39979"
},
{
"name": "RHBZ#2458077",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458077"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39979.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26528"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26542"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28887"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23233"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25044"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34098"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25181"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23245"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16252"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:18048"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:18047"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:18046"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:18045"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:18044"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:18040"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16692"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19151"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:18043"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:18042"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16693"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19365"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25096"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:30078"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:30089"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:30088"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:30087"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8579"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:26528: Red Hat OpenShift Container Platform 4.12"
},
{
"lang": "en",
"value": "RHSA-2026:26542: Red Hat OpenShift Container Platform 4.13"
},
{
"lang": "en",
"value": "RHSA-2026:28887: Red Hat OpenShift Container Platform 4.14"
},
{
"lang": "en",
"value": "RHSA-2026:23233: Red Hat OpenShift Container Platform 4.15"
},
{
"lang": "en",
"value": "RHSA-2026:25044: Red Hat OpenShift Container Platform 4.16"
},
{
"lang": "en",
"value": "RHSA-2026:34098: Red Hat OpenShift Container Platform 4.17"
},
{
"lang": "en",
"value": "RHSA-2026:25181: Red Hat OpenShift Container Platform 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:23245: Red Hat OpenShift Container Platform 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:16252: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:18048: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:18047: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:18046: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:18045: Red Hat Enterprise Linux AppStream E4S (v.9.0)"
},
{
"lang": "en",
"value": "RHSA-2026:18044: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:18040: Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:16692: Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:19151: Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:18043: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux BaseOS EUS (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:18042: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:16693: Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:19365: Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:25096: Red Hat AI Inference Server 3.2"
},
{
"lang": "en",
"value": "RHSA-2026:30078: Red Hat AI Inference Server 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:30089: Red Hat AI Inference Server 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:30088: Red Hat AI Inference Server 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:30087: Red Hat AI Inference Server 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:8579: Red Hat Hardened Images"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-13T23:01:01.219Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-04-13T22:18:56.252Z",
"value": "Made public."
}
],
"title": "jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, manually ensure that every buffer is NUL-terminated before passing it to the \u0027jv_parse_sized\u0027 function."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "jq",
"vendor": "jqlang",
"versions": [
{
"status": "affected",
"version": "\u003c 2f09060afab23fe9390cce7cb860b10416e1bf5f"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-13T22:18:56.252Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p"
},
{
"name": "https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f"
}
],
"source": {
"advisory": "GHSA-2hhh-px8h-355p",
"discovery": "UNKNOWN"
},
"title": "jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-39979",
"datePublished": "2026-04-13T22:18:56.252Z",
"dateReserved": "2026-04-08T00:01:47.628Z",
"dateUpdated": "2026-07-15T01:01:40.651Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-39979",
"date": "2026-09-14",
"epss": "0.00559",
"percentile": "0.44861"
},
"microsoft_vex": {
"current_release_date": "2026-04-24T14:40:12.000Z",
"cve": "CVE-2026-39979",
"id": "msrc_CVE-2026-39979",
"initial_release_date": "2026-04-02T00:00:00.000Z",
"product_status:fixed": "2",
"product_status:known_affected": "2",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-39979.json",
"version": "3"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-39979\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-04-13T23:16:27.823\",\"lastModified\":\"2026-07-15T02:20:54.453\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"jqlang\",\"product\":\"jq\",\"versions\":[{\"version\":\"\u003c 2f09060afab23fe9390cce7cb860b10416e1bf5f\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jq\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.1\",\"cpe:/o:redhat:enterprise_linux:10.2\"],\"versions\":[{\"version\":\"0:1.7.1-11.el10_1.0.2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"},{\"version\":\"0:1.7.1-11.el10_2.2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10.0 Extended Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jq\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux_eus:10.0\"],\"versions\":[{\"version\":\"0:1.7.1-8.el10_0.3\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jq\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:8\"],\"versions\":[{\"version\":\"0:1.6-12.el8_10\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jq\",\"cpes\":[\"cpe:/a:redhat:rhel_aus:8.4\"],\"versions\":[{\"version\":\"0:1.5-12.el8_4.5\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jq\",\"cpes\":[\"cpe:/a:redhat:rhel_eus_long_life:8.4\"],\"versions\":[{\"version\":\"0:1.5-12.el8_4.5\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jq\",\"cpes\":[\"cpe:/a:redhat:rhel_aus:8.6\"],\"versions\":[{\"version\":\"0:1.6-3.el8_6.2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.6 Telecommunications Update Service\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jq\",\"cpes\":[\"cpe:/a:redhat:rhel_tus:8.6\"],\"versions\":[{\"version\":\"0:1.6-3.el8_6.2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jq\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:8.6\"],\"versions\":[{\"version\":\"0:1.6-3.el8_6.2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.8 Telecommunications Update Service\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jq\",\"cpes\":[\"cpe:/a:redhat:rhel_tus:8.8\"],\"versions\":[{\"version\":\"0:1.6-6.el8_8.4\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jq\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:8.8\"],\"versions\":[{\"version\":\"0:1.6-6.el8_8.4\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jq\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"],\"versions\":[{\"version\":\"0:1.6-19.el9_7.0.2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"},{\"version\":\"0:1.6-19.el9_8.2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jq\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:9.0\"],\"versions\":[{\"version\":\"0:1.6-12.el9_0.3\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jq\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:9.2\"],\"versions\":[{\"version\":\"0:1.6-15.el9_2.3\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.4 Extended Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jq\",\"cpes\":[\"cpe:/o:redhat:rhel_eus:9.4\"],\"versions\":[{\"version\":\"0:1.6-16.el9_4.2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.6 Extended Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jq\",\"cpes\":[\"cpe:/o:redhat:rhel_eus:9.6\"],\"versions\":[{\"version\":\"0:1.6-17.el9_6.4\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.12\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhcos\",\"cpes\":[\"cpe:/a:redhat:openshift:4.12::el8\"],\"versions\":[{\"version\":\"412.86.202606140301-0\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.13\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhcos\",\"cpes\":[\"cpe:/a:redhat:openshift:4.13::el9\"],\"versions\":[{\"version\":\"413.92.202606160406-0\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.14\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhcos\",\"cpes\":[\"cpe:/a:redhat:openshift:4.14::el9\"],\"versions\":[{\"version\":\"414.92.202606231112-0\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.15\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhcos\",\"cpes\":[\"cpe:/a:redhat:openshift:4.15::el9\"],\"versions\":[{\"version\":\"415.92.202606030318-0\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.16\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhcos\",\"cpes\":[\"cpe:/a:redhat:openshift:4.16::el9\"],\"versions\":[{\"version\":\"416.94.202606051757-0\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.17\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhcos\",\"cpes\":[\"cpe:/a:redhat:openshift:4.17::el9\"],\"versions\":[{\"version\":\"417.94.202606250942-0\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.18\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhcos\",\"cpes\":[\"cpe:/a:redhat:openshift:4.18::el9\"],\"versions\":[{\"version\":\"418.94.202606051320-0\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4.19\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhcos\",\"cpes\":[\"cpe:/a:redhat:openshift:4.19::el9\"],\"versions\":[{\"version\":\"4.19.9.6.202606031700-0\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server 3.2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhaiis/model-opt-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3.2::el9\"],\"versions\":[{\"version\":\"1780681984\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhaiis/model-opt-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3.3::el9\"],\"versions\":[{\"version\":\"1782352950\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhaiis/vllm-spyre-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3.3::el9\"],\"versions\":[{\"version\":\"1782352919\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhaiis/vllm-rocm-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3.3::el9\"],\"versions\":[{\"version\":\"1782353093\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhaiis/vllm-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3.3::el9\"],\"versions\":[{\"version\":\"1782352847\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jq-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"1.8.1-3.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-26/controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-26/hub-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"automation-controller\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ceph Storage 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jq\",\"cpes\":[\"cpe:/a:redhat:ceph_storage:4\"]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":6.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":2.5},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":4.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-14T13:43:11.607182Z\",\"id\":\"CVE-2026-39979\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2026-04-12\",\"matchCriteriaId\":\"3004A3C4-AF30-42C3-B872-F9EA2CA5FDAB\"}]}]}],\"references\":[{\"url\":\"https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:16252\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:16692\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:16693\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:18040\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:18042\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:18043\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:18044\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:18045\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:18046\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:18047\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:18048\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19151\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19365\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:23233\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:23245\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25044\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25096\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25181\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26528\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26542\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:28887\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:30078\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:30087\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:30088\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:30089\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:34098\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8579\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-39979\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2458077\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39979.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-07-09T17:38:37+00:00",
"cve": "CVE-2026-39979",
"id": "CVE-2026-39979",
"initial_release_date": "2026-04-13T22:18:56.252000+00:00",
"product_status:fixed": "362",
"product_status:known_affected": "2",
"product_status:known_not_affected": "2",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39979.json",
"version": "3"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:openshift:4.12::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.12\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.13::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.13\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.14::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.14\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.15::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.15\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.16\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.17::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.17\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.18\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4.19::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4.19\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:8::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream (v. 8)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_aus:8.4::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream AUS (v.8.4)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_aus:8.6::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream AUS (v.8.6)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:8.6::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream E4S (v.8.6)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_tus:8.6::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream TUS (v.8.6)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:8.8::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream E4S (v.8.8)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_tus:8.8::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream TUS (v.8.8)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:9.0::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream E4S (v.9.0)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:9.2::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AppStream E4S (v.9.2)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux_eus:10.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux BaseOS EUS (v. 10.0)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.1\", \"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux BaseOS (v. 10)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:rhel_eus:9.4::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux BaseOS EUS (v.9.4)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:rhel_eus:9.6::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux BaseOS EUS (v.9.6)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux BaseOS (v. 9)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux_eus:10.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.1\", \"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:8::crb\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux CRB (v. 8)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_eus:9.4::crb\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat CodeReady Linux Builder EUS (v.9.4)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_eus:9.6::crb\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat CodeReady Linux Builder EUS (v.9.6)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9::crb\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3.2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server 3.2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server 3.3\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ceph_storage:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ceph Storage 4\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-04-13T23:01:01.219Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-04-13T22:18:56.252Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:26528: Red Hat OpenShift Container Platform 4.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:26542: Red Hat OpenShift Container Platform 4.13\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:28887: Red Hat OpenShift Container Platform 4.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:23233: Red Hat OpenShift Container Platform 4.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25044: Red Hat OpenShift Container Platform 4.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:34098: Red Hat OpenShift Container Platform 4.17\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25181: Red Hat OpenShift Container Platform 4.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:23245: Red Hat OpenShift Container Platform 4.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:16252: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:18048: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:18047: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:18046: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:18045: Red Hat Enterprise Linux AppStream E4S (v.9.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:18044: Red Hat Enterprise Linux AppStream E4S (v.9.2)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:18040: Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:16692: Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19151: Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:18043: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux BaseOS EUS (v.9.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:18042: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:16693: Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19365: Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25096: Red Hat AI Inference Server 3.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:30078: Red Hat AI Inference Server 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:30089: Red Hat AI Inference Server 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:30088: Red Hat AI Inference Server 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:30087: Red Hat AI Inference Server 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8579: Red Hat Hardened Images\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-04-13T22:18:56.252Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-39979\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2458077\", \"name\": \"RHBZ#2458077\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39979.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26528\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26542\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:28887\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:23233\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25044\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:34098\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25181\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:23245\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:16252\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:18048\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:18047\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:18046\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:18045\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:18044\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:18040\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:16692\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19151\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:18043\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:18042\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:16693\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19365\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25096\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:30078\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:30089\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:30088\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:30087\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8579\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"To mitigate this issue, manually ensure that every buffer is NUL-terminated before passing it to the \u0027jv_parse_sized\u0027 function.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in jq, a command line JSON processor, specifically in the libjq API. Parsing a malformed JSON input from a non-NUL-terminated buffer using the `jv_parse_sized` function can cause an out-of-bounds read, resulting in an application crash and a possible memory disclosure within the error message generated by the parser.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-07-10T12:05:54.906Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-39979\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-14T13:43:11.607182Z\"}}}], \"references\": [{\"url\": \"https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-14T13:43:05.927Z\"}}], \"cna\": {\"title\": \"jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers\", \"source\": {\"advisory\": \"GHSA-2hhh-px8h-355p\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 6.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"LOW\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"jqlang\", \"product\": \"jq\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2f09060afab23fe9390cce7cb860b10416e1bf5f\"}]}], \"references\": [{\"url\": \"https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p\", \"name\": \"https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f\", \"name\": \"https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125: Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-04-13T22:18:56.252Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-39979\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-10T12:05:54.906Z\", \"dateReserved\": \"2026-04-08T00:01:47.628Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-04-13T22:18:56.252Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2026:30089
Vulnerability from csaf_redhat - Published: 2026-06-25 19:32 - Updated: 2026-09-09 22:31Summary
Red Hat Security Advisory: Red Hat AI Inference Server 3.3.5 (CUDA)
Severity
Critical
Notes
Topic: Red Hat AI Inference Server 3.3.5 (CUDA) is now available.
Details: Red Hat® AI Inference Server
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution.
7.8 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the Python webbrowser.open() API. If a specially crafted URL containing "%action" is processed, an attacker could bypass a previous mitigation for CVE-2026-4519. This bypass allows for command injection into the underlying shell, potentially leading to arbitrary code execution.
7.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.
6.7 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Python's decompression modules, including `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile`. This vulnerability, a use-after-free, can occur if a program attempts to re-use a decompression object after a memory allocation error, especially when the system is experiencing high memory usage. Exploitation of this flaw could potentially allow an attacker to execute arbitrary code or access sensitive data. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.
8.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.
7.8 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). A remote attacker can exploit this vulnerability by sending a specially crafted video URL to vLLM's multimodal endpoint. This action causes vLLM to leak a heap memory address, significantly reducing the effectiveness of Address Space Layout Randomization (ASLR). This information disclosure can then be chained with a heap overflow vulnerability to achieve remote code execution.
9.8 (Critical)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Critical
A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). This vulnerability allows a remote attacker to achieve arbitrary code execution on the vLLM host during model loading. This occurs because vLLM loads Hugging Face `auto_map` dynamic modules without properly validating the `trust_remote_code` setting. By influencing the model repository or path, an attacker can execute malicious Python code at server startup, even before any API requests are handled.
8.8 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class, specifically within the load_from_url and load_from_url_async methods. An attacker can exploit differing interpretations of backslashes by Python parsing libraries used for host restrictions to bypass these restrictions. This allows the attacker to force the vLLM server to make arbitrary requests to internal network resources, potentially leading to information disclosure, denial of service, or unauthorized access within containerized environments.
7.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in OpenEXR, an image storage format for the motion picture industry. A remote attacker could exploit an integer overflow vulnerability in the `internal_exr_undo_piz()` function by providing a specially crafted EXR file. This flaw leads to out-of-bounds reads and writes, which may allow for arbitrary code execution or sensitive information disclosure.
8.8 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Vim. A modeline is used to set specific editor options directly from a text file. However, the `complete`, `guitabtooltip`, `printheader` options and the `mapset` function lack proper security checks, allowing an attacker to bypass restrictions and cause arbitrary OS command execution.
8.2 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in OpenSSH. When the `scp` command is used by a root user to download a file with the legacy protocol option (`-O`) and without preserving original file permissions (`-p`), the downloaded file can be installed with elevated privileges (setuid or setgid). This unexpected behavior could allow a malicious file to execute with higher permissions than intended, posing a security risk through potential privilege escalation.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the libsndfile library. An integer overflow in the IMA ADPCM codec can occur when a specially crafted WAV audio file is processed, specifically with malicious samplesperblock and blocks values. This can lead to a heap-based buffer overflow, causing a crash to the application linked to the library and memory corruption.
8.2 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the cryptography library. This vulnerability occurs when a non-contiguous buffer is passed to certain application programming interfaces (APIs) that accept Python buffers, such as Hash.update(). A remote attacker could exploit this to cause a buffer overflow, potentially leading to a denial of service.
7.3 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in jq, a command line JSON processor, specifically in the libjq API. Parsing a malformed JSON input from a non-NUL-terminated buffer using the `jv_parse_sized` function can cause an out-of-bounds read, resulting in an application crash and a possible memory disclosure within the error message generated by the parser.
8.2 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in jq, a command-line JSON processor. A remote attacker could exploit this vulnerability by providing a specially crafted JSON object. This object leverages a weakness in jq's hashing algorithm, which uses a hardcoded, publicly known seed. By crafting the JSON object to cause hash collisions, an attacker can degrade the performance of JSON object hash table operations, leading to significant CPU exhaustion and a denial of service (DoS) for systems processing the malicious JSON data.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.
5.9 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.
7.4 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP `Host` request header. This malformed header could cause the `request.url` to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on `request.url` for validation could be bypassed, potentially allowing unauthorized access or actions.
6.5 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Exploit Status
CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Impact
Moderate
A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). This vulnerability, residing in ASGI web servers and Starlette's trust in them, allows an attacker to bypass the OpenAI API Authentication Middleware. This bypass enables unauthorized access to the API without requiring the configured VLLM_API_KEY or --api-key, leading to critical unauthorized operations.
9.1 (Critical)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Starlette, a lightweight ASGI framework. On Windows systems, the StaticFiles component is vulnerable to Server-Side Request Forgery (SSRF). A remote attacker can exploit this by providing a specially crafted Universal Naming Convention (UNC) path, which causes the system to initiate an outbound Server Message Block (SMB) connection. This action can expose the service account's NTLMv2 credentials, potentially leading to information disclosure or further attacks.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
166 references
Acknowledgments
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat AI Inference Server 3.3.5 (CUDA) is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat\u00ae AI Inference Server",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:30089",
"url": "https://access.redhat.com/errata/RHSA-2026:30089"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-10118",
"url": "https://access.redhat.com/security/cve/CVE-2026-10118"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-22778",
"url": "https://access.redhat.com/security/cve/CVE-2026-22778"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-22807",
"url": "https://access.redhat.com/security/cve/CVE-2026-22807"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-24779",
"url": "https://access.redhat.com/security/cve/CVE-2026-24779"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34588",
"url": "https://access.redhat.com/security/cve/CVE-2026-34588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34982",
"url": "https://access.redhat.com/security/cve/CVE-2026-34982"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-35385",
"url": "https://access.redhat.com/security/cve/CVE-2026-35385"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-37555",
"url": "https://access.redhat.com/security/cve/CVE-2026-37555"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39892",
"url": "https://access.redhat.com/security/cve/CVE-2026-39892"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39979",
"url": "https://access.redhat.com/security/cve/CVE-2026-39979"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40164",
"url": "https://access.redhat.com/security/cve/CVE-2026-40164"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44431",
"url": "https://access.redhat.com/security/cve/CVE-2026-44431"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44432",
"url": "https://access.redhat.com/security/cve/CVE-2026-44432"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4775",
"url": "https://access.redhat.com/security/cve/CVE-2026-4775"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4786",
"url": "https://access.redhat.com/security/cve/CVE-2026-4786"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-48526",
"url": "https://access.redhat.com/security/cve/CVE-2026-48526"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-48710",
"url": "https://access.redhat.com/security/cve/CVE-2026-48710"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-48746",
"url": "https://access.redhat.com/security/cve/CVE-2026-48746"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4878",
"url": "https://access.redhat.com/security/cve/CVE-2026-4878"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-48818",
"url": "https://access.redhat.com/security/cve/CVE-2026-48818"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-6100",
"url": "https://access.redhat.com/security/cve/CVE-2026-6100"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://www.redhat.com/en/products/ai/inference-server",
"url": "https://www.redhat.com/en/products/ai/inference-server"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_30089.json"
}
],
"title": "Red Hat Security Advisory: Red Hat AI Inference Server 3.3.5 (CUDA)",
"tracking": {
"current_release_date": "2026-09-09T22:31:04+00:00",
"generator": {
"date": "2026-09-09T22:31:04+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:30089",
"initial_release_date": "2026-06-25T19:32:31+00:00",
"revision_history": [
{
"date": "2026-06-25T19:32:31+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-04T00:36:24+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-09T22:31:04+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat AI Inference Server 3.3",
"product": {
"name": "Red Hat AI Inference Server 3.3",
"product_id": "Red Hat AI Inference Server 3.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ai_inference_server:3.3::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat AI Inference Server"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64",
"product": {
"name": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64",
"product_id": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64",
"product_identification_helper": {
"purl": "pkg:oci/vllm-cuda-rhel9@sha256%3Ad869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629?arch=amd64\u0026repository_url=registry.redhat.io/rhaiis/vllm-cuda-rhel9\u0026tag=1782352847"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"product": {
"name": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"product_id": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"product_identification_helper": {
"purl": "pkg:oci/vllm-cuda-rhel9@sha256%3A9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309?arch=arm64\u0026repository_url=registry.redhat.io/rhaiis/vllm-cuda-rhel9\u0026tag=1782352847"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64 as a component of Red Hat AI Inference Server 3.3",
"product_id": "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64"
},
"product_reference": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"relates_to_product_reference": "Red Hat AI Inference Server 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64 as a component of Red Hat AI Inference Server 3.3",
"product_id": "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
},
"product_reference": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64",
"relates_to_product_reference": "Red Hat AI Inference Server 3.3"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Quang Luong",
"PrymEvol"
]
}
],
"cve": "CVE-2026-4775",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-03-24T14:23:23.826000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450768"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw in the libtiff library, affecting the processing of specially crafted TIFF files, could lead to a denial of service or potentially arbitrary code execution. This vulnerability, caused by a signed integer overflow during TIFF image processing, results in an out-of-bounds heap write. Red Hat products that process untrusted TIFF files using libtiff may be impacted.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4775"
},
{
"category": "external",
"summary": "RHBZ#2450768",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450768"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4775",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4775"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4775",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4775"
}
],
"release_date": "2026-03-24T14:33:35.730000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-25T19:32:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30089",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:30089"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid processing untrusted or maliciously crafted TIFF files with applications linked against the libtiff library. If processing untrusted TIFF files is unavoidable, consider running the affected applications within a sandboxed environment to limit the potential impact of successful exploitation. This operational control helps contain the effects of an out-of-bounds write, reducing the risk of denial of service or arbitrary code execution.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing"
},
{
"cve": "CVE-2026-4786",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-04-13T22:01:38.006388+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458049"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Python webbrowser.open() API. If a specially crafted URL containing \"%action\" is processed, an attacker could bypass a previous mitigation for CVE-2026-4519. This bypass allows for command injection into the underlying shell, potentially leading to arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw in the Python `webbrowser.open()` API allows for command injection and arbitrary code execution when processing specially crafted URLs containing \"%action\". This bypasses a previous mitigation for CVE-2026-4519.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4786"
},
{
"category": "external",
"summary": "RHBZ#2458049",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4786",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4786"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4786",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4786"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/148169",
"url": "https://github.com/python/cpython/issues/148169"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/148170",
"url": "https://github.com/python/cpython/pull/148170"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/"
}
],
"release_date": "2026-04-13T21:52:19.036000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-25T19:32:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30089",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:30089"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API"
},
{
"acknowledgments": [
{
"names": [
"Ali Raza"
]
}
],
"cve": "CVE-2026-4878",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-03-26T06:56:21.213270+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451615"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw. A Time-of-Check-to-Time-of-Use (TOCTOU) race condition in libcap\u0027s cap_set_file() allows a local unprivileged user to escalate privileges. An attacker with write access to a parent directory can exploit a narrow window during file capability updates to redirect capabilities to an attacker-controlled file. This can lead to the injection of elevated privileges into an unintended executable when privileged processes, such as setcap or container tooling, invoke cap_set_file() on attacker-influenced paths.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4878"
},
{
"category": "external",
"summary": "RHBZ#2451615",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451615"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4878",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4878"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4878",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4878"
},
{
"category": "external",
"summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554"
}
],
"release_date": "2026-04-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-25T19:32:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30089",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:30089"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()"
},
{
"cve": "CVE-2026-6100",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-04-13T18:01:31.970255+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457932"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Python\u0027s decompression modules, including `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile`. This vulnerability, a use-after-free, can occur if a program attempts to re-use a decompression object after a memory allocation error, especially when the system is experiencing high memory usage. Exploitation of this flaw could potentially allow an attacker to execute arbitrary code or access sensitive data. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The severity of this flaw is somewhat mitigated on Red Hat platforms. By default processes are not executed with root user privilege and are limited in their scope which in turn limits the impact of this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6100"
},
{
"category": "external",
"summary": "RHBZ#2457932",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6100",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6100"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6100",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6100"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d",
"url": "https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2",
"url": "https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20",
"url": "https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/148395",
"url": "https://github.com/python/cpython/issues/148395"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/148396",
"url": "https://github.com/python/cpython/pull/148396"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/"
}
],
"release_date": "2026-04-13T17:15:47.606000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-25T19:32:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30089",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:30089"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules"
},
{
"acknowledgments": [
{
"names": [
"AISLE Research"
],
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-10118",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-21T23:20:23+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460428"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Poppler\u0027s Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important heap-based memory corruption flaw in Poppler\u0027s Splash backend. Processing a specially crafted PDF document can lead to an integer overflow, resulting in an undersized heap allocation and a subsequent out-of-bounds write. This could allow an attacker to achieve arbitrary code execution, disclose sensitive information, or cause a denial of service within the context of the application rendering the PDF. To successfully exploit this vulnerability the attacker needs to be able to supply the maliciously crafted PDF file to the application consuming poppler or trick the user to process the PDF file using the Poppler\u0027s backend.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-10118"
},
{
"category": "external",
"summary": "RHBZ#2460428",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460428"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-10118",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-10118"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10118",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10118"
},
{
"category": "external",
"summary": "https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1715",
"url": "https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1715"
}
],
"release_date": "2026-06-01T15:25:35.578000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-25T19:32:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30089",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:30089"
},
{
"category": "workaround",
"details": "To mitigate this issue, users should avoid opening untrusted or suspicious PDF documents with applications that utilize the Poppler library for rendering. Limiting exposure to untrusted content can reduce the risk of exploitation.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication"
},
{
"cve": "CVE-2026-22778",
"cwe": {
"id": "CWE-209",
"name": "Generation of Error Message Containing Sensitive Information"
},
"discovery_date": "2026-02-03T00:01:43.512265+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2436113"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). A remote attacker can exploit this vulnerability by sending a specially crafted video URL to vLLM\u0027s multimodal endpoint. This action causes vLLM to leak a heap memory address, significantly reducing the effectiveness of Address Space Layout Randomization (ASLR). This information disclosure can then be chained with a heap overflow vulnerability to achieve remote code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vLLM: vLLM: Remote code execution via invalid image processing in the multimodal endpoint.",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Critical rather than Important because it allows unauthenticated remote code execution without requiring user interaction, ultimately leading to full compromise of the affected system. An attacker can provide a malicious video URL to a vulnerable vLLM inference endpoint, which causes the service to automatically retrieve and process attacker-controlled media content. During decoding, a heap overflow is triggered in the underlying video processing stack, enabling corruption of heap memory and potential overwriting of control structures to execute arbitrary commands on the host. In addition, an information disclosure condition can leak memory addresses, significantly weakening ASLR protections and making exploitation more reliable when combined with the heap overflow. Successful exploitation compromises the confidentiality, integrity, and availability of the system and can impact deployments such as Red Hat AI Inference Server, Red Hat Enterprise Linux AI, and Red Hat OpenShift AI, thereby meeting Red Hat\u2019s criteria for Critical severity rather than Important impact.\n\nThe vLLM vulnerability depends on CVE-2025-9951, as processing attacker-controlled media can trigger the JPEG2000 decoder heap overflow, which can then be exploited within the vLLM video handling pipeline to cause memory corruption and potentially achieve remote code execution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-22778"
},
{
"category": "external",
"summary": "RHBZ#2436113",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436113"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-22778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22778"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-22778",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22778"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/pull/31987",
"url": "https://github.com/vllm-project/vllm/pull/31987"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/pull/32319",
"url": "https://github.com/vllm-project/vllm/pull/32319"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/releases/tag/v0.14.1",
"url": "https://github.com/vllm-project/vllm/releases/tag/v0.14.1"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-4r2x-xpjr-7cvv",
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-4r2x-xpjr-7cvv"
}
],
"release_date": "2026-02-02T21:09:53.265000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-25T19:32:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30089",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:30089"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "vLLM: vLLM: Remote code execution via invalid image processing in the multimodal endpoint."
},
{
"cve": "CVE-2026-22807",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-01-21T22:00:55.823882+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2431865"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). This vulnerability allows a remote attacker to achieve arbitrary code execution on the vLLM host during model loading. This occurs because vLLM loads Hugging Face `auto_map` dynamic modules without properly validating the `trust_remote_code` setting. By influencing the model repository or path, an attacker can execute malicious Python code at server startup, even before any API requests are handled.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vLLM: vLLM: Arbitrary code execution via untrusted model loading",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important for Red Hat as vLLM, an inference and serving engine for large language models, is vulnerable to arbitrary code execution. An attacker influencing the model repository or path can execute malicious Python code during server startup, affecting vLLM versions 0.10.1 through 0.13.x.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-22807"
},
{
"category": "external",
"summary": "RHBZ#2431865",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431865"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-22807",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22807"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-22807",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22807"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/commit/78d13ea9de4b1ce5e4d8a5af9738fea71fb024e5",
"url": "https://github.com/vllm-project/vllm/commit/78d13ea9de4b1ce5e4d8a5af9738fea71fb024e5"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/pull/32194",
"url": "https://github.com/vllm-project/vllm/pull/32194"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/releases/tag/v0.14.0",
"url": "https://github.com/vllm-project/vllm/releases/tag/v0.14.0"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-2pc9-4j83-qjmr",
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-2pc9-4j83-qjmr"
}
],
"release_date": "2026-01-21T21:13:11.894000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-25T19:32:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30089",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:30089"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure that vLLM instances are configured to load models only from trusted and verified repositories. Restrict access to the model repository path to prevent unauthorized modification or introduction of malicious code. Implement strict access controls and integrity checks for all model sources.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vLLM: vLLM: Arbitrary code execution via untrusted model loading"
},
{
"cve": "CVE-2026-24779",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2026-01-27T23:00:53.998772+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2433624"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class, specifically within the load_from_url and load_from_url_async methods. An attacker can exploit differing interpretations of backslashes by Python parsing libraries used for host restrictions to bypass these restrictions. This allows the attacker to force the vLLM server to make arbitrary requests to internal network resources, potentially leading to information disclosure, denial of service, or unauthorized access within containerized environments.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vLLM: vLLM: Server-Side Request Forgery allows internal network access",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This IMPORTANT Server-Side Request Forgery (SSRF) vulnerability in vLLM\u0027s `MediaConnector` allows an attacker to bypass host restrictions when processing user-provided URLs. This enables the vLLM server to be coerced into making arbitrary requests to internal network resources. This is critical in containerized deployments, including Red Hat AI Inference Server, Red Hat Enterprise Linux AI, and Red Hat OpenShift AI, where it could facilitate internal network reconnaissance and unauthorized access to other services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-24779"
},
{
"category": "external",
"summary": "RHBZ#2433624",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433624"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-24779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24779"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-24779",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24779"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/commit/f46d576c54fb8aeec5fc70560e850bed38ef17d7",
"url": "https://github.com/vllm-project/vllm/commit/f46d576c54fb8aeec5fc70560e850bed38ef17d7"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/pull/32746",
"url": "https://github.com/vllm-project/vllm/pull/32746"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-qh4c-xf7m-gxfc",
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-qh4c-xf7m-gxfc"
}
],
"release_date": "2026-01-27T22:01:13.808000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-25T19:32:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30089",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:30089"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to the vLLM service to only trusted clients. Implement strict network segmentation for vLLM pods in containerized environments to limit potential lateral movement. Ensure that vLLM instances are not exposed to untrusted external networks without proper access controls and input validation at the perimeter.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vLLM: vLLM: Server-Side Request Forgery allows internal network access"
},
{
"cve": "CVE-2026-34588",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-06T16:02:38.673068+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455408"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenEXR, an image storage format for the motion picture industry. A remote attacker could exploit an integer overflow vulnerability in the `internal_exr_undo_piz()` function by providing a specially crafted EXR file. This flaw leads to out-of-bounds reads and writes, which may allow for arbitrary code execution or sensitive information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34588"
},
{
"category": "external",
"summary": "RHBZ#2455408",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455408"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34588"
},
{
"category": "external",
"summary": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-588r-cr5c-w6hf",
"url": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-588r-cr5c-w6hf"
}
],
"release_date": "2026-04-06T15:31:57.602000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-25T19:32:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30089",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:30089"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file"
},
{
"cve": "CVE-2026-34982",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-04-06T16:02:10.004743+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455400"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Vim. A modeline is used to set specific editor options directly from a text file. However, the `complete`, `guitabtooltip`, `printheader` options and the `mapset` function lack proper security checks, allowing an attacker to bypass restrictions and cause arbitrary OS command execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: arbitrary command execution via modeline sandbox bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this vulnerability, an attacker needs to convince a user to open a specially crafted file. The arbitrary OS command execution is restricted to the privileges of the user running Vim, limiting the potential of a full system compromise.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34982"
},
{
"category": "external",
"summary": "RHBZ#2455400",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455400"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34982",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34982"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34982",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34982"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/01/1",
"url": "http://www.openwall.com/lists/oss-security/2026/04/01/1"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615",
"url": "https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/releases/tag/v9.2.0276",
"url": "https://github.com/vim/vim/releases/tag/v9.2.0276"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9",
"url": "https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9"
}
],
"release_date": "2026-04-06T15:16:48.809000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-25T19:32:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30089",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:30089"
},
{
"category": "workaround",
"details": "To mitigate this issue, disable the modeline support by adding the following command to the Vim configuration file:\n\n~~~\nset nomodeline\n~~~",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vim: arbitrary command execution via modeline sandbox bypass"
},
{
"cve": "CVE-2026-35385",
"cwe": {
"id": "CWE-281",
"name": "Improper Preservation of Permissions"
},
"discovery_date": "2026-04-02T17:01:07.052864+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2454469"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSH. When the `scp` command is used by a root user to download a file with the legacy protocol option (`-O`) and without preserving original file permissions (`-p`), the downloaded file can be installed with elevated privileges (setuid or setgid). This unexpected behavior could allow a malicious file to execute with higher permissions than intended, posing a security risk through potential privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-35385"
},
{
"category": "external",
"summary": "RHBZ#2454469",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454469"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-35385",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-35385"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-35385",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35385"
},
{
"category": "external",
"summary": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2",
"url": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2"
},
{
"category": "external",
"summary": "https://www.openssh.org/releasenotes.html#10.3p1",
"url": "https://www.openssh.org/releasenotes.html#10.3p1"
},
{
"category": "external",
"summary": "https://www.openwall.com/lists/oss-security/2026/04/02/3",
"url": "https://www.openwall.com/lists/oss-security/2026/04/02/3"
}
],
"release_date": "2026-04-02T16:30:59.615000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-25T19:32:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30089",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:30089"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode"
},
{
"cve": "CVE-2026-37555",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-29T17:00:55.901773+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463856"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the libsndfile library. An integer overflow in the IMA ADPCM codec can occur when a specially crafted WAV audio file is processed, specifically with malicious samplesperblock and blocks values. This can lead to a heap-based buffer overflow, causing a crash to the application linked to the library and memory corruption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libsndfile: integer overflow in ima_reader_init()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to be able to process a malicious WAV file with an application linked to the libsndfile library.\n\nDefault Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.\n\nDue to these reasons, this flaw has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-37555"
},
{
"category": "external",
"summary": "RHBZ#2463856",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463856"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-37555",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-37555"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-37555",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-37555"
},
{
"category": "external",
"summary": "https://github.com/libsndfile/libsndfile/commit/9a829113c88a51e57c1e46473e90609e4b7df151",
"url": "https://github.com/libsndfile/libsndfile/commit/9a829113c88a51e57c1e46473e90609e4b7df151"
},
{
"category": "external",
"summary": "https://github.com/libsndfile/libsndfile/issues/833",
"url": "https://github.com/libsndfile/libsndfile/issues/833"
}
],
"release_date": "2026-04-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-25T19:32:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30089",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:30089"
},
{
"category": "workaround",
"details": "Do not process untrusted WAV files with the libsndfile library.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libsndfile: integer overflow in ima_reader_init()"
},
{
"cve": "CVE-2026-39892",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-08T22:00:59.416053+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456735"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the cryptography library. This vulnerability occurs when a non-contiguous buffer is passed to certain application programming interfaces (APIs) that accept Python buffers, such as Hash.update(). A remote attacker could exploit this to cause a buffer overflow, potentially leading to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In default configurations Red Hat products isolate service processes from total system access. Should an attacker be able to exploit this vulnerability their impact will be limited to that service account and they will not have access to the broader system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39892"
},
{
"category": "external",
"summary": "RHBZ#2456735",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456735"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39892",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39892"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39892",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39892"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/08/12",
"url": "http://www.openwall.com/lists/oss-security/2026/04/08/12"
},
{
"category": "external",
"summary": "https://github.com/pyca/cryptography/commit/622d672e429a7cff836a23c5903683dbec1901f5",
"url": "https://github.com/pyca/cryptography/commit/622d672e429a7cff836a23c5903683dbec1901f5"
},
{
"category": "external",
"summary": "https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq",
"url": "https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq"
}
],
"release_date": "2026-04-08T20:49:41.967000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-25T19:32:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30089",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:30089"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API"
},
{
"cve": "CVE-2026-39979",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-04-13T23:01:01.219840+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458077"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jq, a command line JSON processor, specifically in the libjq API. Parsing a malformed JSON input from a non-NUL-terminated buffer using the `jv_parse_sized` function can cause an out-of-bounds read, resulting in an application crash and a possible memory disclosure within the error message generated by the parser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to supply malformed JSON from a non-NUL-terminated buffer to an application using the `jv_parse_sized` function. This allows the attacker to trigger the out-of-bounds read, causing an application crash and potentially disclosing memory with no other security impact. As this issue affects the libjq library, it is more likely to be exposed to untrusted input. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39979"
},
{
"category": "external",
"summary": "RHBZ#2458077",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458077"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39979",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39979"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39979",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39979"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f",
"url": "https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p",
"url": "https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p"
}
],
"release_date": "2026-04-13T22:18:56.252000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-25T19:32:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30089",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:30089"
},
{
"category": "workaround",
"details": "To mitigate this issue, manually ensure that every buffer is NUL-terminated before passing it to the \u0027jv_parse_sized\u0027 function.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers"
},
{
"cve": "CVE-2026-40164",
"cwe": {
"id": "CWE-341",
"name": "Predictable from Observable State"
},
"discovery_date": "2026-04-14T00:01:04.003115+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458084"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jq, a command-line JSON processor. A remote attacker could exploit this vulnerability by providing a specially crafted JSON object. This object leverages a weakness in jq\u0027s hashing algorithm, which uses a hardcoded, publicly known seed. By crafting the JSON object to cause hash collisions, an attacker can degrade the performance of JSON object hash table operations, leading to significant CPU exhaustion and a denial of service (DoS) for systems processing the malicious JSON data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jq: jq: Denial of Service via crafted JSON object causing hash collisions",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40164"
},
{
"category": "external",
"summary": "RHBZ#2458084",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458084"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40164",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40164"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40164",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40164"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/commit/0c7d133c3c7e37c00b6d46b658a02244fdd3c784",
"url": "https://github.com/jqlang/jq/commit/0c7d133c3c7e37c00b6d46b658a02244fdd3c784"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/security/advisories/GHSA-wwj8-gxm6-jc29",
"url": "https://github.com/jqlang/jq/security/advisories/GHSA-wwj8-gxm6-jc29"
}
],
"release_date": "2026-04-13T23:40:12.693000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-25T19:32:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30089",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:30089"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jq: jq: Denial of Service via crafted JSON object causing hash collisions"
},
{
"cve": "CVE-2026-44431",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-05-13T17:01:41.663622+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477167"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44431"
},
{
"category": "external",
"summary": "RHBZ#2477167",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477167"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44431",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44431"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"
}
],
"release_date": "2026-05-13T15:20:24.588000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-25T19:32:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30089",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:30089"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers"
},
{
"cve": "CVE-2026-44432",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-05-13T17:01:01.083841+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477154"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44432"
},
{
"category": "external",
"summary": "RHBZ#2477154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"
}
],
"release_date": "2026-05-13T15:17:12.611000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-25T19:32:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30089",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:30089"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression"
},
{
"cve": "CVE-2026-48526",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-05-28T16:01:22.805235+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2482734"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer\u0027s public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in PyJWT allows for authentication bypass and unauthorized access. It occurs when a JWT verifier is misconfigured to accept both symmetric and asymmetric algorithms, and a public JSON Web Key is erroneously used as the HMAC secret. Red Hat products are only affected if they utilize this specific, non-standard verifier configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48526"
},
{
"category": "external",
"summary": "RHBZ#2482734",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482734"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48526",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48526"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx",
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx"
}
],
"release_date": "2026-05-28T15:09:09.258000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-25T19:32:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30089",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:30089"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens"
},
{
"cve": "CVE-2026-48710",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-26T23:01:03.204374+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2481742"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP `Host` request header. This malformed header could cause the `request.url` to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on `request.url` for validation could be bypassed, potentially allowing unauthorized access or actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The impact of this vulnerability is rated Moderate. A malformed Host header can manipulate the reconstructed request.url.path, introducing a discrepancy with the canonical ASGI request path (scope[\"path\"]). However, the vulnerability does not directly grant access, modify routing, or bypass security controls on its own. A path-based authentication or authorization bypass is possible only if an application depends on request.url.path for access control decisions rather than the canonical ASGI path or standard framework mechanisms. The impact relies heavily on downstream application design rather than a default library failure.\n\nRed Hat Satellite / Insights (IoP): The starlette package is included as a dependency of Connexion, but this flaw is rated Low impact because these services do not use path-based authentication middleware and all services are deployed behind reverse proxies. \n\nOpenShift Lightspeed (OLS): The starlette package is included as a dependency, but this flaw is rated Low impact because authentication is enforced via Kubernetes TokenReview/SubjectAccessReview through FastAPI dependency injection, not path-based middleware; request.url.path is only used for metrics and response header application.\n\nRHOAI Kubeflow Training images: starlette is being used as indirect dependency of mlflow, but this flaw is rated as Low impact because mlflow is used as client library only to store training metrics on remote server, it doesn\u0027t expose any endpoint.\n\nRHOAI odh-automl: The impact is reduced to Low since starlette is only used in the backend and it\u0027s transient dependency and starlette is not used at all to serve any endpoints.\n\nRHOAI odh-kserve-autogluon-server-rhel9: While the Starlette dependency is present in the build, the vulnerable code in starlette is not reachable. This reduces the impact to low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48710"
},
{
"category": "external",
"summary": "RHBZ#2481742",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481742"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48710",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48710"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48710",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48710"
},
{
"category": "external",
"summary": "https://badhost.org",
"url": "https://badhost.org"
},
{
"category": "external",
"summary": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6",
"url": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"
},
{
"category": "external",
"summary": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr",
"url": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"
},
{
"category": "external",
"summary": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml"
},
{
"category": "external",
"summary": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette",
"url": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"
},
{
"category": "external",
"summary": "https://www.secwest.net/starlette",
"url": "https://www.secwest.net/starlette"
},
{
"category": "external",
"summary": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette",
"url": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"
},
{
"category": "external",
"summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
}
],
"release_date": "2026-05-26T21:54:54.393000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-25T19:32:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30089",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:30089"
},
{
"category": "workaround",
"details": "Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"threats": [
{
"category": "exploit_status",
"date": "2026-09-02T00:00:00+00:00",
"details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
},
{
"category": "impact",
"details": "Moderate"
}
],
"title": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header"
},
{
"cve": "CVE-2026-48746",
"cwe": {
"id": "CWE-501",
"name": "Trust Boundary Violation"
},
"discovery_date": "2026-06-22T23:00:57.824402+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491581"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). This vulnerability, residing in ASGI web servers and Starlette\u0027s trust in them, allows an attacker to bypass the OpenAI API Authentication Middleware. This bypass enables unauthorized access to the API without requiring the configured VLLM_API_KEY or --api-key, leading to critical unauthorized operations.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vllm: starlette: vLLM: Critical authentication bypass allows unauthorized API access",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "CVE-2026-48746 is an authentication bypass in the vLLM OpenAI-compatible API server. A remote attacker who can reach the vLLM endpoint directly can craft a Host header so the authentication middleware checks a different URL path than the one actually dispatched, bypassing VLLM_API_KEY / --api-key protection. Successful exploitation allows unauthorized inference API access, which can result in confidentiality loss (model/prompt abuse) and availability impact (resource exhaustion). The flaw does not provide integrity compromise or arbitrary code execution. Exploitation requires vLLM API-key authentication to be enabled and the service to be exposed without an RFC-conforming reverse proxy that normalizes the Host header. Because Red Hat AI inference offerings are commonly deployed behind OpenShift Routes or similar proxies, and because the vulnerability is conditional on deployment and configuration, the overall flaw impact is rated Important rather than Critical.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48746"
},
{
"category": "external",
"summary": "RHBZ#2491581",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491581"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48746",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48746"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48746",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48746"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/pull/43426",
"url": "https://github.com/vllm-project/vllm/pull/43426"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-94f4-hr76-p5j6",
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-94f4-hr76-p5j6"
},
{
"category": "external",
"summary": "https://x41-dsec.de/lab/advisories/x41-2026-002-starlette",
"url": "https://x41-dsec.de/lab/advisories/x41-2026-002-starlette"
}
],
"release_date": "2026-06-22T21:57:28.997000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-25T19:32:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30089",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:30089"
},
{
"category": "workaround",
"details": "Restrict network access to the vLLM API endpoint to only trusted clients and internal networks. Implement firewall rules or network policies to limit inbound connections to the vLLM service, thereby reducing the attack surface. This operational control helps prevent unauthorized external access to the vulnerable API.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vllm: starlette: vLLM: Critical authentication bypass allows unauthorized API access"
},
{
"cve": "CVE-2026-48818",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2026-06-17T19:03:44.998691+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2490020"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Starlette, a lightweight ASGI framework. On Windows systems, the StaticFiles component is vulnerable to Server-Side Request Forgery (SSRF). A remote attacker can exploit this by providing a specially crafted Universal Naming Convention (UNC) path, which causes the system to initiate an outbound Server Message Block (SMB) connection. This action can expose the service account\u0027s NTLMv2 credentials, potentially leading to information disclosure or further attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "starlette: Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Starlette\u0027s StaticFiles component, which allows for NTLMv2 credential theft via specially crafted UNC paths, does not affect Red Hat products. The vulnerability is specific to Windows operating systems, and the vulnerable code is not present in Red Hat\u0027s supported configurations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48818"
},
{
"category": "external",
"summary": "RHBZ#2490020",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490020"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48818",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48818"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48818",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48818"
},
{
"category": "external",
"summary": "https://github.com/Kludex/starlette/commit/fd53168a7767b6b55ba5af787fd88f49e33cabc5",
"url": "https://github.com/Kludex/starlette/commit/fd53168a7767b6b55ba5af787fd88f49e33cabc5"
},
{
"category": "external",
"summary": "https://github.com/Kludex/starlette/pull/3287",
"url": "https://github.com/Kludex/starlette/pull/3287"
},
{
"category": "external",
"summary": "https://github.com/Kludex/starlette/releases/tag/1.1.0",
"url": "https://github.com/Kludex/starlette/releases/tag/1.1.0"
},
{
"category": "external",
"summary": "https://github.com/Kludex/starlette/security/advisories/GHSA-wqp7-x3pw-xc5r",
"url": "https://github.com/Kludex/starlette/security/advisories/GHSA-wqp7-x3pw-xc5r"
}
],
"release_date": "2026-06-17T17:50:12.399000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-25T19:32:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30089",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:30089"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:9165ca6c4f41ed4f5cdf5c590bfad74e22abe23737adfdc40a4c4b340b10e309_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:d869df392f711437069fa0c808428694c945d4b79e5dd77c718f68403cd71629_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "starlette: Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows"
}
]
}
RHSA-2026:34098
Vulnerability from csaf_redhat - Published: 2026-07-09 08:03 - Updated: 2026-09-14 18:26Summary
Red Hat Security Advisory: OpenShift Container Platform 4.17.55 bug fix and security update
Severity
Critical
Notes
Topic: Red Hat OpenShift Container Platform release 4.17.55 is now available with
updates to packages and images that fix several bugs and add enhancements.
This release includes a security update for Red Hat OpenShift Container
Platform 4.17.
Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
Details: Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container
Platform 4.17.55. See the following advisory for the RPM packages for this
release:
https://access.redhat.com/errata/RHSA-2026:34097
Space precludes documenting all of the container images in this advisory.
See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/
Security Fix(es):
* kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)
* libcap: libcap: Privilege escalation via TOCTOU race condition in
cap_set_file() (CVE-2026-4878)
* OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not
preserving file mode (CVE-2026-35385)
* sudo: Sudo: Privilege escalation due to failure in privilege drop calls
(CVE-2026-35535)
* jq: out-of-bounds read in jv_parse_sized() on error formatting for
non-NUL-terminated buffers (CVE-2026-39979)
* jq: jq: Denial of Service via crafted JSON object causing hash collisions
(CVE-2026-40164)
* rsync: Rsync: Use-after-free vulnerability in extended attribute handling
(CVE-2026-41035)
* kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege
Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284)
* kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the
ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the
Linux kernel (CVE-2026-46300)
* kernel: net/sched: act_pedit: extend the writable skb range per key
(CVE-2026-46331)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
All OpenShift Container Platform 4.17 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.
6.7 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in OpenSSH. When the `scp` command is used by a root user to download a file with the legacy protocol option (`-O`) and without preserving original file permissions (`-p`), the downloaded file can be installed with elevated privileges (setuid or setgid). This unexpected behavior could allow a malicious file to execute with higher permissions than intended, posing a security risk through potential privilege escalation.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Sudo. A local user could exploit a failure in the setuid, setgid, or setgroups calls, which are used to drop privileges before running the mailer. This oversight allows for privilege escalation, enabling the user to gain elevated access on the system.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in jq, a command line JSON processor, specifically in the libjq API. Parsing a malformed JSON input from a non-NUL-terminated buffer using the `jv_parse_sized` function can cause an out-of-bounds read, resulting in an application crash and a possible memory disclosure within the error message generated by the parser.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in jq, a command-line JSON processor. A remote attacker could exploit this vulnerability by providing a specially crafted JSON object. This object leverages a weakness in jq's hashing algorithm, which uses a hardcoded, publicly known seed. By crafting the JSON object to cause hash collisions, an attacker can degrade the performance of JSON object hash table operations, leading to significant CPU exhaustion and a denial of service (DoS) for systems processing the malicious JSON data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in rsync. When rsync is configured to handle extended attributes (using the -X or --xattrs option), a remote attacker can exploit a use-after-free vulnerability. This occurs because the receive_xattr function incorrectly processes an untrusted length value during a sorting operation, leading to memory corruption. Successful exploitation can result in a denial of service, causing the rsync process to crash, and may potentially allow for arbitrary code execution.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the Linux kernel's IPv6 tunnel implementation. A remote attacker could exploit this flaw by sending malicious ICMPv6 error messages to cause a stack-based buffer overflow in the kernel's IPv4-over-IPv6 tunnel error handling code. This could result in a kernel crash (denial of service) or potentially allow arbitrary code execution with kernel privileges.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Critical
A flaw was found in the Linux kernel's xfrm-ESP and RxRPC subsystems. Unsafe in-place cryptographic processing of shared socket buffer fragments allows a low-privileged local attacker to corrupt page-cache contents of readable files, including sensitive system files, and gain root privileges. The xfrm-ESP variant requires unprivileged user or network namespace creation, while the RxRPC variant depends on the rxrpc module being available on the target system.
7.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the Linux kernel's XFRM ESP-in-TCP subsystem. Unsafe in-place cryptographic processing allows a low-privileged local attacker to write arbitrary bytes into the page cache of read-only files, including sensitive system files. An attacker can exploit this to overwrite privileged binaries and gain root privileges.
7.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the Linux kernel's traffic control packet editing (pedit) subsystem. In tcf_pedit_act(), the copy-on-write (COW) range for skb_ensure_writable() is computed once before iterating over edit keys, but the calculation does not account for runtime header offsets added by typed keys. This can leave part of the target write region without a proper copy-on-write, leading to an out-of-bounds write that corrupts page cache memory. A local attacker with the ability to configure traffic control rules could exploit this to escalate privileges or crash the system.
6.7 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Low
References
73 references
Acknowledgments
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat OpenShift Container Platform release 4.17.55 is now available with\nupdates to packages and images that fix several bugs and add enhancements.\n\n This release includes a security update for Red Hat OpenShift Container\nPlatform 4.17.\n\nRed Hat Product Security has rated this update as having a security impact\nof Critical. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nThis advisory contains the container images for Red Hat OpenShift Container\nPlatform 4.17.55. See the following advisory for the RPM packages for this\nrelease:\n\nhttps://access.redhat.com/errata/RHSA-2026:34097\n\nSpace precludes documenting all of the container images in this advisory.\nSee the following Release Notes documentation, which will be updated\nshortly for this release, for details about these changes:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/\n\nSecurity Fix(es):\n\n* kernel: ip6_tunnel: clear skb2-\u003ecb[] in ip4ip6_err() (CVE-2026-43037)\n* libcap: libcap: Privilege escalation via TOCTOU race condition in\ncap_set_file() (CVE-2026-4878)\n* OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not\npreserving file mode (CVE-2026-35385)\n* sudo: Sudo: Privilege escalation due to failure in privilege drop calls\n(CVE-2026-35535)\n* jq: out-of-bounds read in jv_parse_sized() on error formatting for\nnon-NUL-terminated buffers (CVE-2026-39979)\n* jq: jq: Denial of Service via crafted JSON object causing hash collisions\n(CVE-2026-40164)\n* rsync: Rsync: Use-after-free vulnerability in extended attribute handling\n(CVE-2026-41035)\n* kernel: \"Dirty Frag\" ESP XFRM variant is a new universal Local Privilege\nEscalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284)\n* kernel: \"Fragnesia\" is a variant of Dirty Frag vulnerability in the\nESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the\nLinux kernel (CVE-2026-46300)\n* kernel: net/sched: act_pedit: extend the writable skb range per key\n(CVE-2026-46331)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.\n\nAll OpenShift Container Platform 4.17 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:34098",
"url": "https://access.redhat.com/errata/RHSA-2026:34098"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "external",
"summary": "2451615",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451615"
},
{
"category": "external",
"summary": "2454469",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454469"
},
{
"category": "external",
"summary": "2454714",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454714"
},
{
"category": "external",
"summary": "2458077",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458077"
},
{
"category": "external",
"summary": "2458084",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458084"
},
{
"category": "external",
"summary": "2458898",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458898"
},
{
"category": "external",
"summary": "2464351",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464351"
},
{
"category": "external",
"summary": "2467771",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467771"
},
{
"category": "external",
"summary": "2477015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477015"
},
{
"category": "external",
"summary": "2479492",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479492"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34098.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Container Platform 4.17.55 bug fix and security update",
"tracking": {
"current_release_date": "2026-09-14T18:26:47+00:00",
"generator": {
"date": "2026-09-14T18:26:47+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.21"
}
},
"id": "RHSA-2026:34098",
"initial_release_date": "2026-07-09T08:03:47+00:00",
"revision_history": [
{
"date": "2026-07-09T08:03:47+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-09T08:03:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-14T18:26:47+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.17",
"product": {
"name": "Red Hat OpenShift Container Platform 4.17",
"product_id": "9Base-RHOSE-4.17",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.17::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-aarch64-417.94.202606250942-0",
"product": {
"name": "rhcos-aarch64-417.94.202606250942-0",
"product_id": "rhcos-aarch64-417.94.202606250942-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@417.94.202606250942?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-ppc64le-417.94.202606250942-0",
"product": {
"name": "rhcos-ppc64le-417.94.202606250942-0",
"product_id": "rhcos-ppc64le-417.94.202606250942-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@417.94.202606250942?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-s390x-417.94.202606250942-0",
"product": {
"name": "rhcos-s390x-417.94.202606250942-0",
"product_id": "rhcos-s390x-417.94.202606250942-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@417.94.202606250942?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-x86_64-417.94.202606250942-0",
"product": {
"name": "rhcos-x86_64-417.94.202606250942-0",
"product_id": "rhcos-x86_64-417.94.202606250942-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@417.94.202606250942?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-aarch64-417.94.202606250942-0 as a component of Red Hat OpenShift Container Platform 4.17",
"product_id": "9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0"
},
"product_reference": "rhcos-aarch64-417.94.202606250942-0",
"relates_to_product_reference": "9Base-RHOSE-4.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-ppc64le-417.94.202606250942-0 as a component of Red Hat OpenShift Container Platform 4.17",
"product_id": "9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0"
},
"product_reference": "rhcos-ppc64le-417.94.202606250942-0",
"relates_to_product_reference": "9Base-RHOSE-4.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-s390x-417.94.202606250942-0 as a component of Red Hat OpenShift Container Platform 4.17",
"product_id": "9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0"
},
"product_reference": "rhcos-s390x-417.94.202606250942-0",
"relates_to_product_reference": "9Base-RHOSE-4.17"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-x86_64-417.94.202606250942-0 as a component of Red Hat OpenShift Container Platform 4.17",
"product_id": "9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
},
"product_reference": "rhcos-x86_64-417.94.202606250942-0",
"relates_to_product_reference": "9Base-RHOSE-4.17"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Ali Raza"
]
}
],
"cve": "CVE-2026-4878",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-03-26T06:56:21.213270+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451615"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw. A Time-of-Check-to-Time-of-Use (TOCTOU) race condition in libcap\u0027s cap_set_file() allows a local unprivileged user to escalate privileges. An attacker with write access to a parent directory can exploit a narrow window during file capability updates to redirect capabilities to an attacker-controlled file. This can lead to the injection of elevated privileges into an unintended executable when privileged processes, such as setcap or container tooling, invoke cap_set_file() on attacker-influenced paths.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4878"
},
{
"category": "external",
"summary": "RHBZ#2451615",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451615"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4878",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4878"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4878",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4878"
},
{
"category": "external",
"summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554"
}
],
"release_date": "2026-04-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-09T08:03:47+00:00",
"details": "For OpenShift Container Platform 4.17 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:6f09cb9bc01cfd9f61f9d8297505f7777217c804fab8f5589b9444b8e1284169\n\n (For s390x architecture)\n The image digest is sha256:22a38b418eb7f9435f697123bf117662d4d6b725bb4d3e20042ade7bcc616abb\n\n (For ppc64le architecture)\n The image digest is sha256:24fdfdca3a35e1b783f2eae0a46a69cc62a3b89994bb2367f4530a9249ba4765\n\n (For aarch64 architecture)\n The image digest is sha256:cf3b8c3e3ff5ce4051aaa96edf6d4b471e9ec5312c4378dffc8fc520c8aef66a\n\nAll OpenShift Container Platform 4.17 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:34098"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()"
},
{
"cve": "CVE-2026-35385",
"cwe": {
"id": "CWE-281",
"name": "Improper Preservation of Permissions"
},
"discovery_date": "2026-04-02T17:01:07.052864+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2454469"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSH. When the `scp` command is used by a root user to download a file with the legacy protocol option (`-O`) and without preserving original file permissions (`-p`), the downloaded file can be installed with elevated privileges (setuid or setgid). This unexpected behavior could allow a malicious file to execute with higher permissions than intended, posing a security risk through potential privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-35385"
},
{
"category": "external",
"summary": "RHBZ#2454469",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454469"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-35385",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-35385"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-35385",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35385"
},
{
"category": "external",
"summary": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2",
"url": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2"
},
{
"category": "external",
"summary": "https://www.openssh.org/releasenotes.html#10.3p1",
"url": "https://www.openssh.org/releasenotes.html#10.3p1"
},
{
"category": "external",
"summary": "https://www.openwall.com/lists/oss-security/2026/04/02/3",
"url": "https://www.openwall.com/lists/oss-security/2026/04/02/3"
}
],
"release_date": "2026-04-02T16:30:59.615000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-09T08:03:47+00:00",
"details": "For OpenShift Container Platform 4.17 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:6f09cb9bc01cfd9f61f9d8297505f7777217c804fab8f5589b9444b8e1284169\n\n (For s390x architecture)\n The image digest is sha256:22a38b418eb7f9435f697123bf117662d4d6b725bb4d3e20042ade7bcc616abb\n\n (For ppc64le architecture)\n The image digest is sha256:24fdfdca3a35e1b783f2eae0a46a69cc62a3b89994bb2367f4530a9249ba4765\n\n (For aarch64 architecture)\n The image digest is sha256:cf3b8c3e3ff5ce4051aaa96edf6d4b471e9ec5312c4378dffc8fc520c8aef66a\n\nAll OpenShift Container Platform 4.17 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:34098"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode"
},
{
"cve": "CVE-2026-35535",
"cwe": {
"id": "CWE-272",
"name": "Least Privilege Violation"
},
"discovery_date": "2026-04-03T03:01:03.124541+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2454714"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Sudo. A local user could exploit a failure in the setuid, setgid, or setgroups calls, which are used to drop privileges before running the mailer. This oversight allows for privilege escalation, enabling the user to gain elevated access on the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "sudo: Sudo: Privilege escalation due to failure in privilege drop calls",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-35535"
},
{
"category": "external",
"summary": "RHBZ#2454714",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454714"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-35535",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-35535"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-35535",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35535"
},
{
"category": "external",
"summary": "https://bugs.debian.org/1130593",
"url": "https://bugs.debian.org/1130593"
},
{
"category": "external",
"summary": "https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/2143042",
"url": "https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/2143042"
},
{
"category": "external",
"summary": "https://github.com/sudo-project/sudo/commit/3e474c2f201484be83d994ae10a4e20e8c81bb69",
"url": "https://github.com/sudo-project/sudo/commit/3e474c2f201484be83d994ae10a4e20e8c81bb69"
},
{
"category": "external",
"summary": "https://www.qualys.com/2026/03/10/crack-armor.txt",
"url": "https://www.qualys.com/2026/03/10/crack-armor.txt"
}
],
"release_date": "2026-04-03T02:21:33.584000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-09T08:03:47+00:00",
"details": "For OpenShift Container Platform 4.17 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:6f09cb9bc01cfd9f61f9d8297505f7777217c804fab8f5589b9444b8e1284169\n\n (For s390x architecture)\n The image digest is sha256:22a38b418eb7f9435f697123bf117662d4d6b725bb4d3e20042ade7bcc616abb\n\n (For ppc64le architecture)\n The image digest is sha256:24fdfdca3a35e1b783f2eae0a46a69cc62a3b89994bb2367f4530a9249ba4765\n\n (For aarch64 architecture)\n The image digest is sha256:cf3b8c3e3ff5ce4051aaa96edf6d4b471e9ec5312c4378dffc8fc520c8aef66a\n\nAll OpenShift Container Platform 4.17 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:34098"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "sudo: Sudo: Privilege escalation due to failure in privilege drop calls"
},
{
"cve": "CVE-2026-39979",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-04-13T23:01:01.219840+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458077"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jq, a command line JSON processor, specifically in the libjq API. Parsing a malformed JSON input from a non-NUL-terminated buffer using the `jv_parse_sized` function can cause an out-of-bounds read, resulting in an application crash and a possible memory disclosure within the error message generated by the parser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to supply malformed JSON from a non-NUL-terminated buffer to an application using the `jv_parse_sized` function. This allows the attacker to trigger the out-of-bounds read, causing an application crash and potentially disclosing memory with no other security impact. As this issue affects the libjq library, it is more likely to be exposed to untrusted input. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39979"
},
{
"category": "external",
"summary": "RHBZ#2458077",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458077"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39979",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39979"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39979",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39979"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f",
"url": "https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p",
"url": "https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p"
}
],
"release_date": "2026-04-13T22:18:56.252000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-09T08:03:47+00:00",
"details": "For OpenShift Container Platform 4.17 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:6f09cb9bc01cfd9f61f9d8297505f7777217c804fab8f5589b9444b8e1284169\n\n (For s390x architecture)\n The image digest is sha256:22a38b418eb7f9435f697123bf117662d4d6b725bb4d3e20042ade7bcc616abb\n\n (For ppc64le architecture)\n The image digest is sha256:24fdfdca3a35e1b783f2eae0a46a69cc62a3b89994bb2367f4530a9249ba4765\n\n (For aarch64 architecture)\n The image digest is sha256:cf3b8c3e3ff5ce4051aaa96edf6d4b471e9ec5312c4378dffc8fc520c8aef66a\n\nAll OpenShift Container Platform 4.17 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:34098"
},
{
"category": "workaround",
"details": "To mitigate this issue, manually ensure that every buffer is NUL-terminated before passing it to the \u0027jv_parse_sized\u0027 function.",
"product_ids": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers"
},
{
"cve": "CVE-2026-40164",
"cwe": {
"id": "CWE-341",
"name": "Predictable from Observable State"
},
"discovery_date": "2026-04-14T00:01:04.003115+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458084"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jq, a command-line JSON processor. A remote attacker could exploit this vulnerability by providing a specially crafted JSON object. This object leverages a weakness in jq\u0027s hashing algorithm, which uses a hardcoded, publicly known seed. By crafting the JSON object to cause hash collisions, an attacker can degrade the performance of JSON object hash table operations, leading to significant CPU exhaustion and a denial of service (DoS) for systems processing the malicious JSON data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jq: jq: Denial of Service via crafted JSON object causing hash collisions",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40164"
},
{
"category": "external",
"summary": "RHBZ#2458084",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458084"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40164",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40164"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40164",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40164"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/commit/0c7d133c3c7e37c00b6d46b658a02244fdd3c784",
"url": "https://github.com/jqlang/jq/commit/0c7d133c3c7e37c00b6d46b658a02244fdd3c784"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/security/advisories/GHSA-wwj8-gxm6-jc29",
"url": "https://github.com/jqlang/jq/security/advisories/GHSA-wwj8-gxm6-jc29"
}
],
"release_date": "2026-04-13T23:40:12.693000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-09T08:03:47+00:00",
"details": "For OpenShift Container Platform 4.17 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:6f09cb9bc01cfd9f61f9d8297505f7777217c804fab8f5589b9444b8e1284169\n\n (For s390x architecture)\n The image digest is sha256:22a38b418eb7f9435f697123bf117662d4d6b725bb4d3e20042ade7bcc616abb\n\n (For ppc64le architecture)\n The image digest is sha256:24fdfdca3a35e1b783f2eae0a46a69cc62a3b89994bb2367f4530a9249ba4765\n\n (For aarch64 architecture)\n The image digest is sha256:cf3b8c3e3ff5ce4051aaa96edf6d4b471e9ec5312c4378dffc8fc520c8aef66a\n\nAll OpenShift Container Platform 4.17 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:34098"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jq: jq: Denial of Service via crafted JSON object causing hash collisions"
},
{
"cve": "CVE-2026-41035",
"cwe": {
"id": "CWE-805",
"name": "Buffer Access with Incorrect Length Value"
},
"discovery_date": "2026-04-16T08:00:54.200357+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458898"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. When rsync is configured to handle extended attributes (using the -X or --xattrs option), a remote attacker can exploit a use-after-free vulnerability. This occurs because the receive_xattr function incorrectly processes an untrusted length value during a sorting operation, leading to memory corruption. Successful exploitation can result in a denial of service, causing the rsync process to crash, and may potentially allow for arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: Rsync: Use-after-free vulnerability in extended attribute handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in rsync that allows a remote attacker to cause a denial of service or potentially execute arbitrary code. The vulnerability is present when rsync is used with extended attributes enabled via the `-X` or `--xattrs` option, which is not a default configuration. Exploitation requires the victim to explicitly enable this feature.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41035"
},
{
"category": "external",
"summary": "RHBZ#2458898",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458898"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41035",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41035"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41035",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41035"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/issues/871",
"url": "https://github.com/RsyncProject/rsync/issues/871"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases",
"url": "https://github.com/RsyncProject/rsync/releases"
},
{
"category": "external",
"summary": "https://www.openwall.com/lists/oss-security/2026/04/16/2",
"url": "https://www.openwall.com/lists/oss-security/2026/04/16/2"
}
],
"release_date": "2026-04-16T06:53:05.237000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-09T08:03:47+00:00",
"details": "For OpenShift Container Platform 4.17 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:6f09cb9bc01cfd9f61f9d8297505f7777217c804fab8f5589b9444b8e1284169\n\n (For s390x architecture)\n The image digest is sha256:22a38b418eb7f9435f697123bf117662d4d6b725bb4d3e20042ade7bcc616abb\n\n (For ppc64le architecture)\n The image digest is sha256:24fdfdca3a35e1b783f2eae0a46a69cc62a3b89994bb2367f4530a9249ba4765\n\n (For aarch64 architecture)\n The image digest is sha256:cf3b8c3e3ff5ce4051aaa96edf6d4b471e9ec5312c4378dffc8fc520c8aef66a\n\nAll OpenShift Container Platform 4.17 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:34098"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, avoid using the -X or --xattrs options with rsync if extended attribute handling is not essential for your operations. Disabling these options prevents the vulnerable code path from being exercised. This may impact functionality that relies on extended attributes.",
"product_ids": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: Rsync: Use-after-free vulnerability in extended attribute handling"
},
{
"cve": "CVE-2026-43037",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
},
"discovery_date": "2026-05-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2464351"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s IPv6 tunnel implementation. A remote attacker could exploit this flaw by sending malicious ICMPv6 error messages to cause a stack-based buffer overflow in the kernel\u0027s IPv4-over-IPv6 tunnel error handling code. This could result in a kernel crash (denial of service) or potentially allow arbitrary code execution with kernel privileges.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: ip6_tunnel: clear skb2-\u003ecb[] in ip4ip6_err()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Critical flaw in the Linux kernel\u0027s IPv6 tunneling error handling can lead to a stack buffer overflow. An unauthenticated remote attacker could exploit this by sending specially crafted network packets, potentially resulting in a denial of service or information disclosure on affected Red Hat Enterprise Linux systems.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-43037"
},
{
"category": "external",
"summary": "RHBZ#2464351",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464351"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-43037",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43037"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43037",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43037"
},
{
"category": "external",
"summary": "https://lore.kernel.org/linux-cve-announce/2026050102-CVE-2026-43037-0346@gregkh/T",
"url": "https://lore.kernel.org/linux-cve-announce/2026050102-CVE-2026-43037-0346@gregkh/T"
}
],
"release_date": "2026-05-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-09T08:03:47+00:00",
"details": "For OpenShift Container Platform 4.17 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:6f09cb9bc01cfd9f61f9d8297505f7777217c804fab8f5589b9444b8e1284169\n\n (For s390x architecture)\n The image digest is sha256:22a38b418eb7f9435f697123bf117662d4d6b725bb4d3e20042ade7bcc616abb\n\n (For ppc64le architecture)\n The image digest is sha256:24fdfdca3a35e1b783f2eae0a46a69cc62a3b89994bb2367f4530a9249ba4765\n\n (For aarch64 architecture)\n The image digest is sha256:cf3b8c3e3ff5ce4051aaa96edf6d4b471e9ec5312c4378dffc8fc520c8aef66a\n\nAll OpenShift Container Platform 4.17 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:34098"
},
{
"category": "workaround",
"details": "Mitigation for this issue is to skip loading the affected module `ip6_tunnel` onto the system till we have a fix available, this can be done by a blacklist mechanism, this will ensure the driver is not loaded at the boot time.\n~~~\nHow do I blacklist a kernel module to prevent it from loading automatically? \nhttps://access.redhat.com/solutions/41278 \n~~~\n\nWe may also want to detection and monitoring an affected system as below:\n~~~\nMonitor for exploitation attempts:\n\n# Enable kernel audit for IPv6 tunnel operations\nauditctl -a always,exit -F arch=b64 -S socket -F a0=10 -F a1=3 -k ipv6_tunnel\n\n# Monitor system logs for kernel panics/crashes\njournalctl -k -p err -f | grep -i \"ip6_tunnel\\|icmp\\|stack\"\n~~~",
"product_ids": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "kernel: ip6_tunnel: clear skb2-\u003ecb[] in ip4ip6_err()"
},
{
"cve": "CVE-2026-43284",
"cwe": {
"id": "CWE-123",
"name": "Write-what-where Condition"
},
"discovery_date": "2026-05-07T15:56:04.044000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467771"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s xfrm-ESP and RxRPC subsystems. Unsafe in-place cryptographic processing of shared socket buffer fragments allows a low-privileged local attacker to corrupt page-cache contents of readable files, including sensitive system files, and gain root privileges. The xfrm-ESP variant requires unprivileged user or network namespace creation, while the RxRPC variant depends on the rxrpc module being available on the target system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: \"Dirty Frag\" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is classified as Important, rather than Critical severity, because exploitation requires local access to the system. A low-privileged local attacker can exploit this flaw in the Linux kernel\u0027s xfrm-ESP and RxRPC subsystems to gain root privileges by overwriting sensitive system files. Exploitation does not require user interaction, potentially resulting in full compromise of confidentiality, integrity, and availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-43284"
},
{
"category": "external",
"summary": "RHBZ#2467771",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467771"
},
{
"category": "external",
"summary": "RHSB-2026-003",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-003"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-43284",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43284"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43284",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43284"
},
{
"category": "external",
"summary": "https://dirtyfrag.io/",
"url": "https://dirtyfrag.io/"
}
],
"release_date": "2026-05-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-09T08:03:47+00:00",
"details": "For OpenShift Container Platform 4.17 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:6f09cb9bc01cfd9f61f9d8297505f7777217c804fab8f5589b9444b8e1284169\n\n (For s390x architecture)\n The image digest is sha256:22a38b418eb7f9435f697123bf117662d4d6b725bb4d3e20042ade7bcc616abb\n\n (For ppc64le architecture)\n The image digest is sha256:24fdfdca3a35e1b783f2eae0a46a69cc62a3b89994bb2367f4530a9249ba4765\n\n (For aarch64 architecture)\n The image digest is sha256:cf3b8c3e3ff5ce4051aaa96edf6d4b471e9ec5312c4378dffc8fc520c8aef66a\n\nAll OpenShift Container Platform 4.17 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:34098"
},
{
"category": "workaround",
"details": "See the security bulletin for a detailed mitigation procedure.",
"product_ids": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: \"Dirty Frag\" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel"
},
{
"cve": "CVE-2026-46300",
"cwe": {
"id": "CWE-123",
"name": "Write-what-where Condition"
},
"discovery_date": "2026-05-13T13:28:21.270000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s XFRM ESP-in-TCP subsystem. Unsafe in-place cryptographic processing allows a low-privileged local attacker to write arbitrary bytes into the page cache of read-only files, including sensitive system files. An attacker can exploit this to overwrite privileged binaries and gain root privileges.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: \"Fragnesia\" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is classified as Important, rather than Critical severity, because exploitation requires local access to the system. A low-privileged local attacker can exploit this flaw in the Linux kernel\u0027s XFRM ESP-in-TCP subsystem to gain root privileges by overwriting sensitive system files. Exploitation does not require user interaction, potentially resulting in full compromise of confidentiality, integrity, and availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46300"
},
{
"category": "external",
"summary": "RHBZ#2477015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477015"
},
{
"category": "external",
"summary": "RHSB-2026-003",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-003"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46300",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46300"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46300",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46300"
}
],
"release_date": "2026-05-13T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-09T08:03:47+00:00",
"details": "For OpenShift Container Platform 4.17 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:6f09cb9bc01cfd9f61f9d8297505f7777217c804fab8f5589b9444b8e1284169\n\n (For s390x architecture)\n The image digest is sha256:22a38b418eb7f9435f697123bf117662d4d6b725bb4d3e20042ade7bcc616abb\n\n (For ppc64le architecture)\n The image digest is sha256:24fdfdca3a35e1b783f2eae0a46a69cc62a3b89994bb2367f4530a9249ba4765\n\n (For aarch64 architecture)\n The image digest is sha256:cf3b8c3e3ff5ce4051aaa96edf6d4b471e9ec5312c4378dffc8fc520c8aef66a\n\nAll OpenShift Container Platform 4.17 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:34098"
},
{
"category": "workaround",
"details": "See the security bulletin for a detailed mitigation procedure.",
"product_ids": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: \"Fragnesia\" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel"
},
{
"cve": "CVE-2026-46331",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-05-18T06:17:23.219000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2479492"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s traffic control packet editing (pedit) subsystem. In tcf_pedit_act(), the copy-on-write (COW) range for skb_ensure_writable() is computed once before iterating over edit keys, but the calculation does not account for runtime header offsets added by typed keys. This can leave part of the target write region without a proper copy-on-write, leading to an out-of-bounds write that corrupts page cache memory. A local attacker with the ability to configure traffic control rules could exploit this to escalate privileges or crash the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: net/sched: act_pedit: extend the writable skb range per key",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw as Important severity.\n\nThis vulnerability is in the kernel\u0027s traffic control (tc) pedit action, which requires CAP_NET_ADMIN capability to configure. By default in Red Hat Enterprise Linux, this limits exploitation to the root user or processes explicitly granted network administration capabilities. However, in some circumstances unprivileged users may obtain CAP_NET_ADMIN within user namespaces. Successful exploitation could lead to arbitrary code execution in kernel context or a system crash.\n\nRed Hat Enterprise Linux 7 and earlier are not affected. Within OpenShift Container Platform, the vulnerable module is not loaded by default, reducing the severity to Low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46331"
},
{
"category": "external",
"summary": "RHBZ#2479492",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479492"
},
{
"category": "external",
"summary": "RHSB-2026-008",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46331"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46331",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46331"
},
{
"category": "external",
"summary": "https://lore.kernel.org/netdev/20260516162825.1480113-1-rollkingzzc@gmail.com/",
"url": "https://lore.kernel.org/netdev/20260516162825.1480113-1-rollkingzzc@gmail.com/"
}
],
"release_date": "2026-05-18T04:04:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-09T08:03:47+00:00",
"details": "For OpenShift Container Platform 4.17 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:6f09cb9bc01cfd9f61f9d8297505f7777217c804fab8f5589b9444b8e1284169\n\n (For s390x architecture)\n The image digest is sha256:22a38b418eb7f9435f697123bf117662d4d6b725bb4d3e20042ade7bcc616abb\n\n (For ppc64le architecture)\n The image digest is sha256:24fdfdca3a35e1b783f2eae0a46a69cc62a3b89994bb2367f4530a9249ba4765\n\n (For aarch64 architecture)\n The image digest is sha256:cf3b8c3e3ff5ce4051aaa96edf6d4b471e9ec5312c4378dffc8fc520c8aef66a\n\nAll OpenShift Container Platform 4.17 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:34098"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, prevent the \u0027act_pedit\u0027 kernel module from loading. Create a file `/etc/modprobe.d/disable-act_pedit.conf` with the following content:\n\n`install act_pedit /bin/true`\n\nThen, regenerate the initramfs and reboot the system for the changes to take effect. This may impact network traffic control functionality that relies on the pedit action.",
"product_ids": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.17:rhcos-aarch64-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-ppc64le-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-s390x-417.94.202606250942-0",
"9Base-RHOSE-4.17:rhcos-x86_64-417.94.202606250942-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "kernel: net/sched: act_pedit: extend the writable skb range per key"
}
]
}
RHSA-2026:8579
Vulnerability from csaf_redhat - Published: 2026-04-16 20:52 - Updated: 2026-09-08 03:00Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
jq:
* jq-1.8.1-3.hum1 (aarch64, x86_64)
* jq-devel-1.8.1-3.hum1 (aarch64, x86_64)
* jq-1.8.1-3.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jq, a command-line JSON processor. An attacker can exploit an integer overflow vulnerability by crafting queries that produce extremely large strings. This causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, leading to a drastically undersized memory buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap-based buffer overflow. This can result in a Denial of Service (DoS) by crashing the process or potentially allow for further exploitation through heap corruption.
6.8 (Medium)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:jq-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jq-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jq-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in jq, a command line JSON processor. Processing a crafted JSON document, specifically when a large array is used as a path argument to the `jv_setpath`, `jv_getpath` and `delpaths_sorted` functions can lead to an uncontrolled recursion and exhausts the call stack, causing an application crash and resulting in a denial of service.
6.2 (Medium)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:jq-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jq-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jq-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in jq, a command-line JSON processor. This vulnerability allows a remote attacker to bypass input validation by crafting malicious JSON input containing embedded null (NUL) bytes. Due to incorrect handling of input buffer lengths, jq truncates the input at the first NUL byte, validating only the benign prefix and silently discarding any malicious data that follows. This can lead to parser differential attacks where downstream systems, relying on jq for validation, may process the full, unvalidated input, potentially leading to unexpected behavior or security compromises.
CWE-170 - Improper Null TerminationAffected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:jq-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jq-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jq-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Low
A flaw was found in jq, a command line JSON processor. In release builds, the `_strindices` builtin function calls the `jv_string_indexes` function without checking that the arguments are actually strings. This missing validation allows an attacker who can supply non-string inputs to cause an application crash and a limited memory read.
6.1 (Medium)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:jq-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jq-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jq-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in jq, a command line JSON processor, specifically in the libjq API. Parsing a malformed JSON input from a non-NUL-terminated buffer using the `jv_parse_sized` function can cause an out-of-bounds read, resulting in an application crash and a possible memory disclosure within the error message generated by the parser.
8.2 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:jq-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jq-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jq-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in jq, a command-line JSON processor. A remote attacker could exploit this vulnerability by providing a specially crafted JSON object. This object leverages a weakness in jq's hashing algorithm, which uses a hardcoded, publicly known seed. By crafting the JSON object to cause hash collisions, an attacker can degrade the performance of JSON object hash table operations, leading to significant CPU exhaustion and a denial of service (DoS) for systems processing the malicious JSON data.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:jq-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jq-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:jq-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
46 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\njq:\n * jq-1.8.1-3.hum1 (aarch64, x86_64)\n * jq-devel-1.8.1-3.hum1 (aarch64, x86_64)\n * jq-1.8.1-3.hum1.src (src)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:8579",
"url": "https://access.redhat.com/errata/RHSA-2026:8579"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40164",
"url": "https://access.redhat.com/security/cve/CVE-2026-40164"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39979",
"url": "https://access.redhat.com/security/cve/CVE-2026-39979"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39956",
"url": "https://access.redhat.com/security/cve/CVE-2026-39956"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33948",
"url": "https://access.redhat.com/security/cve/CVE-2026-33948"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33947",
"url": "https://access.redhat.com/security/cve/CVE-2026-33947"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32316",
"url": "https://access.redhat.com/security/cve/CVE-2026-32316"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8579.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-09-08T03:00:58+00:00",
"generator": {
"date": "2026-09-08T03:00:58+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:8579",
"initial_release_date": "2026-04-16T20:52:41+00:00",
"revision_history": [
{
"date": "2026-04-16T20:52:41+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-04T00:36:24+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-08T03:00:58+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "jq-main@aarch64",
"product": {
"name": "jq-main@aarch64",
"product_id": "jq-main@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jq@1.8.1-3.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "jq-main@src",
"product": {
"name": "jq-main@src",
"product_id": "jq-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jq@1.8.1-3.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "jq-main@x86_64",
"product": {
"name": "jq-main@x86_64",
"product_id": "jq-main@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jq@1.8.1-3.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-main@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:jq-main@aarch64"
},
"product_reference": "jq-main@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:jq-main@src"
},
"product_reference": "jq-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-main@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:jq-main@x86_64"
},
"product_reference": "jq-main@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-32316",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-13T18:01:18.475688+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2457929"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jq, a command-line JSON processor. An attacker can exploit an integer overflow vulnerability by crafting queries that produce extremely large strings. This causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, leading to a drastically undersized memory buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap-based buffer overflow. This can result in a Denial of Service (DoS) by crashing the process or potentially allow for further exploitation through heap corruption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jq: jq: Denial of Service or potential arbitrary code execution due to integer overflow and heap-based buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact vulnerability in `jq`, a command-line JSON processor, allows for a Denial of Service or potential arbitrary code execution. The flaw occurs when `jq` processes untrusted queries that generate excessively large strings, leading to an integer overflow and heap-based buffer overflow. Red Hat products that utilize `jq` for processing JSON data are affected if they handle untrusted `jq` queries.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32316"
},
{
"category": "external",
"summary": "RHBZ#2457929",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457929"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32316",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32316"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/commit/e47e56d226519635768e6aab2f38f0ab037c09e5",
"url": "https://github.com/jqlang/jq/commit/e47e56d226519635768e6aab2f38f0ab037c09e5"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/security/advisories/GHSA-q3h9-m34w-h76f",
"url": "https://github.com/jqlang/jq/security/advisories/GHSA-q3h9-m34w-h76f"
}
],
"release_date": "2026-04-13T17:49:34.095000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T20:52:41+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8579"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid processing untrusted or unvalidated JSON input with the `jq` utility. Ensure that any scripts or automated processes utilizing `jq` only operate on trusted data sources. Restricting the execution of `jq` to trusted users and environments can also reduce exposure.",
"product_ids": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jq: jq: Denial of Service or potential arbitrary code execution due to integer overflow and heap-based buffer overflow"
},
{
"cve": "CVE-2026-33947",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"discovery_date": "2026-04-13T22:00:57.898147+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458038"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jq, a command line JSON processor. Processing a crafted JSON document, specifically when a large array is used as a path argument to the `jv_setpath`, `jv_getpath` and `delpaths_sorted` functions can lead to an uncontrolled recursion and exhausts the call stack, causing an application crash and resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jq: unbounded Recursion in jv_setpath() / jv_getpath() / delpaths_sorted()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to supply a crafted JSON input to be processed by jq with the `setpath`, `getpath` or `delpaths` builtins. This allows the attacker to cause an application crash with no other security impact. Due to these reasons, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33947"
},
{
"category": "external",
"summary": "RHBZ#2458038",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458038"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33947",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33947"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33947",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33947"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/commit/fb59f1491058d58bdc3e8dd28f1773d1ac690a1f",
"url": "https://github.com/jqlang/jq/commit/fb59f1491058d58bdc3e8dd28f1773d1ac690a1f"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/security/advisories/GHSA-xwrw-4f8h-rjvg",
"url": "https://github.com/jqlang/jq/security/advisories/GHSA-xwrw-4f8h-rjvg"
}
],
"release_date": "2026-04-13T21:50:18.814000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T20:52:41+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8579"
},
{
"category": "workaround",
"details": "Do not process untrusted input with the jq command line JSON processor.",
"product_ids": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jq: unbounded Recursion in jv_setpath() / jv_getpath() / delpaths_sorted()"
},
{
"cve": "CVE-2026-33948",
"cwe": {
"id": "CWE-170",
"name": "Improper Null Termination"
},
"discovery_date": "2026-04-14T00:01:07.744754+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458085"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jq, a command-line JSON processor. This vulnerability allows a remote attacker to bypass input validation by crafting malicious JSON input containing embedded null (NUL) bytes. Due to incorrect handling of input buffer lengths, jq truncates the input at the first NUL byte, validating only the benign prefix and silently discarding any malicious data that follows. This can lead to parser differential attacks where downstream systems, relying on jq for validation, may process the full, unvalidated input, potentially leading to unexpected behavior or security compromises.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jq: jq: Input validation bypass via embedded NUL bytes allows parser differential attacks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `jq` allows an attacker to bypass input validation by embedding NUL bytes in JSON input. This is relevant in Red Hat environments where `jq` is used to validate untrusted JSON before it is processed by other tools, potentially leading to parser differential attacks and unexpected behavior in downstream systems. The `jq` command line tool is not exposed to the network in default configurations of Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33948"
},
{
"category": "external",
"summary": "RHBZ#2458085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458085"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33948",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33948"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33948",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33948"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/commit/6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b",
"url": "https://github.com/jqlang/jq/commit/6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/security/advisories/GHSA-32cx-cvvh-2wj9",
"url": "https://github.com/jqlang/jq/security/advisories/GHSA-32cx-cvvh-2wj9"
}
],
"release_date": "2026-04-13T23:51:04.144000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T20:52:41+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8579"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.8,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "jq: jq: Input validation bypass via embedded NUL bytes allows parser differential attacks"
},
{
"cve": "CVE-2026-39956",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-04-13T23:00:57.627615+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458076"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jq, a command line JSON processor. In release builds, the `_strindices` builtin function calls the `jv_string_indexes` function without checking that the arguments are actually strings. This missing validation allows an attacker who can supply non-string inputs to cause an application crash and a limited memory read.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jq: missing runtime type checks for _strindices lead to crash and limited memory disclosure",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, a user needs to process JSON input with an attacker-supplied argument to the `_strindices` builtin. This allows the attacker to cause an application crash and a limited memory read with no other security impact. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39956"
},
{
"category": "external",
"summary": "RHBZ#2458076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458076"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39956",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39956"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39956",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39956"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/commit/fdf8ef0f0810e3d365cdd5160de43db46f57ed03",
"url": "https://github.com/jqlang/jq/commit/fdf8ef0f0810e3d365cdd5160de43db46f57ed03"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/security/advisories/GHSA-6gc3-3g9p-xx28",
"url": "https://github.com/jqlang/jq/security/advisories/GHSA-6gc3-3g9p-xx28"
}
],
"release_date": "2026-04-13T22:10:18.817000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T20:52:41+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8579"
},
{
"category": "workaround",
"details": "Do not use untrusted input as an argument to a jq builtin, specifically \u0027_strindices\u0027.",
"product_ids": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jq: missing runtime type checks for _strindices lead to crash and limited memory disclosure"
},
{
"cve": "CVE-2026-39979",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-04-13T23:01:01.219840+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458077"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jq, a command line JSON processor, specifically in the libjq API. Parsing a malformed JSON input from a non-NUL-terminated buffer using the `jv_parse_sized` function can cause an out-of-bounds read, resulting in an application crash and a possible memory disclosure within the error message generated by the parser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to supply malformed JSON from a non-NUL-terminated buffer to an application using the `jv_parse_sized` function. This allows the attacker to trigger the out-of-bounds read, causing an application crash and potentially disclosing memory with no other security impact. As this issue affects the libjq library, it is more likely to be exposed to untrusted input. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39979"
},
{
"category": "external",
"summary": "RHBZ#2458077",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458077"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39979",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39979"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39979",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39979"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f",
"url": "https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p",
"url": "https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p"
}
],
"release_date": "2026-04-13T22:18:56.252000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T20:52:41+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8579"
},
{
"category": "workaround",
"details": "To mitigate this issue, manually ensure that every buffer is NUL-terminated before passing it to the \u0027jv_parse_sized\u0027 function.",
"product_ids": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers"
},
{
"cve": "CVE-2026-40164",
"cwe": {
"id": "CWE-341",
"name": "Predictable from Observable State"
},
"discovery_date": "2026-04-14T00:01:04.003115+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2458084"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jq, a command-line JSON processor. A remote attacker could exploit this vulnerability by providing a specially crafted JSON object. This object leverages a weakness in jq\u0027s hashing algorithm, which uses a hardcoded, publicly known seed. By crafting the JSON object to cause hash collisions, an attacker can degrade the performance of JSON object hash table operations, leading to significant CPU exhaustion and a denial of service (DoS) for systems processing the malicious JSON data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jq: jq: Denial of Service via crafted JSON object causing hash collisions",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40164"
},
{
"category": "external",
"summary": "RHBZ#2458084",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458084"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40164",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40164"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40164",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40164"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/commit/0c7d133c3c7e37c00b6d46b658a02244fdd3c784",
"url": "https://github.com/jqlang/jq/commit/0c7d133c3c7e37c00b6d46b658a02244fdd3c784"
},
{
"category": "external",
"summary": "https://github.com/jqlang/jq/security/advisories/GHSA-wwj8-gxm6-jc29",
"url": "https://github.com/jqlang/jq/security/advisories/GHSA-wwj8-gxm6-jc29"
}
],
"release_date": "2026-04-13T23:40:12.693000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T20:52:41+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8579"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:jq-main@aarch64",
"Red Hat Hardened Images:jq-main@src",
"Red Hat Hardened Images:jq-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jq: jq: Denial of Service via crafted JSON object causing hash collisions"
}
]
}
SUSE-SU-2026:22545-1
Vulnerability from csaf_suse - Published: 2026-07-07 12:32 - Updated: 2026-09-14 16:11Summary
Security update for jq
Severity
Important
Notes
Title of the patch: Security update for jq
Description of the patch: This update for jq fixes the following issues:
- CVE-2025-48060: improper handling of string data in `jv_string_empty` can lead to heap buffer overflow and a crash
when processing crafted input (bsc#1244116).
- CVE-2026-32316: integer overflow within the `jvp_string_append()` and `jvp_string_copy_replace_bad` functions can
lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).
- CVE-2026-33947: unbounded recursion in functions `jv_setpath()`, `jv_getpath()`, and `delpaths_sorted()` can lead to
excessive resource consumption when processing crafted JSON input (bsc#1262069).
- CVE-2026-39956: missing runtime type checks in `_strindices` and `jv_string_indexes()` can lead to a crash when
evaluating untrusted jq filters against a release build (bsc#1262070).
- CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in `jv_parse_sized` can lead to an
out-of-bounds read when processing malformed JSON (bsc#1262071).
- CVE-2026-40164: use of `MurmurHash3` with a hardcoded seed allows pre-computation of key collisions and can lead to a
denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).
- CVE-2026-40612: recursion into nested arrays/objects with no depth limit in `jv_contains` can lead to a C stack
exhaustion when processing crafted input (bsc#1265060).
- CVE-2026-41256: truncation of top-level jq programs loaded with `-f` and can lead to the execution of unintended
programs (bsc#1265061).
- CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS when processing jq
bytecode (bsc#1265062).
- CVE-2026-43894: signed integer overflow in the `decNumberFromString` `D2U()` macro can lead to an out-of-bounds
memory write when processing large number literals (bsc#1265070).
- CVE-2026-33948: improper handling of buffer sizes via `strlen()` instead of `fgets()` in CLI input parsing allows
validation bypass via embedded NUL bytes (bsc#1262043).
Patchnames: SUSE-SL-Micro-6.2-1169
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.3 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.8 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.1 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.6 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.8 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
49 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for jq",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for jq fixes the following issues:\n\n- CVE-2025-48060: improper handling of string data in `jv_string_empty` can lead to heap buffer overflow and a crash\n when processing crafted input (bsc#1244116).\n- CVE-2026-32316: integer overflow within the `jvp_string_append()` and `jvp_string_copy_replace_bad` functions can\n lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).\n- CVE-2026-33947: unbounded recursion in functions `jv_setpath()`, `jv_getpath()`, and `delpaths_sorted()` can lead to\n excessive resource consumption when processing crafted JSON input (bsc#1262069).\n- CVE-2026-39956: missing runtime type checks in `_strindices` and `jv_string_indexes()` can lead to a crash when\n evaluating untrusted jq filters against a release build (bsc#1262070).\n- CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in `jv_parse_sized` can lead to an\n out-of-bounds read when processing malformed JSON (bsc#1262071).\n- CVE-2026-40164: use of `MurmurHash3` with a hardcoded seed allows pre-computation of key collisions and can lead to a\n denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).\n- CVE-2026-40612: recursion into nested arrays/objects with no depth limit in `jv_contains` can lead to a C stack\n exhaustion when processing crafted input (bsc#1265060).\n- CVE-2026-41256: truncation of top-level jq programs loaded with `-f` and can lead to the execution of unintended\n programs (bsc#1265061).\n- CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS when processing jq\n bytecode (bsc#1265062).\n- CVE-2026-43894: signed integer overflow in the `decNumberFromString` `D2U()` macro can lead to an out-of-bounds\n memory write when processing large number literals (bsc#1265070).\n- CVE-2026-33948: improper handling of buffer sizes via `strlen()` instead of `fgets()` in CLI input parsing allows\n validation bypass via embedded NUL bytes (bsc#1262043).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SL-Micro-6.2-1169",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22545-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22545-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622545-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22545-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-July/048136.html"
},
{
"category": "self",
"summary": "SUSE Bug 1244116",
"url": "https://bugzilla.suse.com/1244116"
},
{
"category": "self",
"summary": "SUSE Bug 1262043",
"url": "https://bugzilla.suse.com/1262043"
},
{
"category": "self",
"summary": "SUSE Bug 1262044",
"url": "https://bugzilla.suse.com/1262044"
},
{
"category": "self",
"summary": "SUSE Bug 1262069",
"url": "https://bugzilla.suse.com/1262069"
},
{
"category": "self",
"summary": "SUSE Bug 1262070",
"url": "https://bugzilla.suse.com/1262070"
},
{
"category": "self",
"summary": "SUSE Bug 1262071",
"url": "https://bugzilla.suse.com/1262071"
},
{
"category": "self",
"summary": "SUSE Bug 1262072",
"url": "https://bugzilla.suse.com/1262072"
},
{
"category": "self",
"summary": "SUSE Bug 1265060",
"url": "https://bugzilla.suse.com/1265060"
},
{
"category": "self",
"summary": "SUSE Bug 1265061",
"url": "https://bugzilla.suse.com/1265061"
},
{
"category": "self",
"summary": "SUSE Bug 1265062",
"url": "https://bugzilla.suse.com/1265062"
},
{
"category": "self",
"summary": "SUSE Bug 1265070",
"url": "https://bugzilla.suse.com/1265070"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-48060 page",
"url": "https://www.suse.com/security/cve/CVE-2025-48060/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-32316 page",
"url": "https://www.suse.com/security/cve/CVE-2026-32316/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33947 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33947/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33948 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33948/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39956 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39956/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39979 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39979/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-40164 page",
"url": "https://www.suse.com/security/cve/CVE-2026-40164/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-40612 page",
"url": "https://www.suse.com/security/cve/CVE-2026-40612/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41256 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41256/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41257 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41257/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-43894 page",
"url": "https://www.suse.com/security/cve/CVE-2026-43894/"
}
],
"title": "Security update for jq",
"tracking": {
"current_release_date": "2026-09-14T16:11:44Z",
"generator": {
"date": "2026-07-07T12:32:43Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22545-1",
"initial_release_date": "2026-07-07T12:32:43Z",
"revision_history": [
{
"date": "2026-07-07T12:32:43Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-14T16:11:44Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "jq-1.7.1-160000.3.1.aarch64",
"product": {
"name": "jq-1.7.1-160000.3.1.aarch64",
"product_id": "jq-1.7.1-160000.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "libjq1-1.7.1-160000.3.1.aarch64",
"product": {
"name": "libjq1-1.7.1-160000.3.1.aarch64",
"product_id": "libjq1-1.7.1-160000.3.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "jq-1.7.1-160000.3.1.ppc64le",
"product": {
"name": "jq-1.7.1-160000.3.1.ppc64le",
"product_id": "jq-1.7.1-160000.3.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libjq1-1.7.1-160000.3.1.ppc64le",
"product": {
"name": "libjq1-1.7.1-160000.3.1.ppc64le",
"product_id": "libjq1-1.7.1-160000.3.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "jq-1.7.1-160000.3.1.s390x",
"product": {
"name": "jq-1.7.1-160000.3.1.s390x",
"product_id": "jq-1.7.1-160000.3.1.s390x"
}
},
{
"category": "product_version",
"name": "libjq1-1.7.1-160000.3.1.s390x",
"product": {
"name": "libjq1-1.7.1-160000.3.1.s390x",
"product_id": "libjq1-1.7.1-160000.3.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "jq-1.7.1-160000.3.1.x86_64",
"product": {
"name": "jq-1.7.1-160000.3.1.x86_64",
"product_id": "jq-1.7.1-160000.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "libjq1-1.7.1-160000.3.1.x86_64",
"product": {
"name": "libjq1-1.7.1-160000.3.1.x86_64",
"product_id": "libjq1-1.7.1-160000.3.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.2",
"product": {
"name": "SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.2"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-1.7.1-160000.3.1.aarch64 as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64"
},
"product_reference": "jq-1.7.1-160000.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-1.7.1-160000.3.1.ppc64le as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le"
},
"product_reference": "jq-1.7.1-160000.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-1.7.1-160000.3.1.s390x as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x"
},
"product_reference": "jq-1.7.1-160000.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-1.7.1-160000.3.1.x86_64 as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64"
},
"product_reference": "jq-1.7.1-160000.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq1-1.7.1-160000.3.1.aarch64 as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64"
},
"product_reference": "libjq1-1.7.1-160000.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq1-1.7.1-160000.3.1.ppc64le as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le"
},
"product_reference": "libjq1-1.7.1-160000.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq1-1.7.1-160000.3.1.s390x as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x"
},
"product_reference": "libjq1-1.7.1-160000.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq1-1.7.1-160000.3.1.x86_64 as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
},
"product_reference": "libjq1-1.7.1-160000.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-48060",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-48060"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 `void* p = malloc(sz);`. As of time of publication, no patched versions are available.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-48060",
"url": "https://www.suse.com/security/cve/CVE-2025-48060"
},
{
"category": "external",
"summary": "SUSE Bug 1244116 for CVE-2025-48060",
"url": "https://bugzilla.suse.com/1244116"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-07T12:32:43Z",
"details": "moderate"
}
],
"title": "CVE-2025-48060"
},
{
"cve": "CVE-2026-32316",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-32316"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-32316",
"url": "https://www.suse.com/security/cve/CVE-2026-32316"
},
{
"category": "external",
"summary": "SUSE Bug 1262044 for CVE-2026-32316",
"url": "https://bugzilla.suse.com/1262044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-07T12:32:43Z",
"details": "moderate"
}
],
"title": "CVE-2026-32316"
},
{
"cve": "CVE-2026-33947",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33947"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(), and delpaths_sorted() in jq\u0027s src/jv_aux.c use unbounded recursion whose depth is controlled by the length of a caller-supplied path array, with no depth limit enforced. An attacker can supply a JSON document containing a flat array of ~65,000 integers (~200 KB) that, when used as a path argument by a trusted jq filter, exhausts the C call stack and crashes the process with a segmentation fault (SIGSEGV). This bypass works because the existing MAX_PARSING_DEPTH (10,000) limit only protects the JSON parser, not runtime path operations where arrays can be programmatically constructed to arbitrary lengths. The impact is denial of service (unrecoverable crash) affecting any application or service that processes untrusted JSON input through jq\u0027s setpath, getpath, or delpaths builtins. This issue has been addressed in commit fb59f1491058d58bdc3e8dd28f1773d1ac690a1f.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33947",
"url": "https://www.suse.com/security/cve/CVE-2026-33947"
},
{
"category": "external",
"summary": "SUSE Bug 1262069 for CVE-2026-33947",
"url": "https://bugzilla.suse.com/1262069"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-07T12:32:43Z",
"details": "moderate"
}
],
"title": "CVE-2026-33947"
},
{
"cve": "CVE-2026-33948",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33948"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33948",
"url": "https://www.suse.com/security/cve/CVE-2026-33948"
},
{
"category": "external",
"summary": "SUSE Bug 1262043 for CVE-2026-33948",
"url": "https://bugzilla.suse.com/1262043"
},
{
"category": "external",
"summary": "SUSE Bug 1265061 for CVE-2026-33948",
"url": "https://bugzilla.suse.com/1265061"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-07T12:32:43Z",
"details": "moderate"
}
],
"title": "CVE-2026-33948"
},
{
"cve": "CVE-2026-39956",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39956"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. Prior to version 1.8.2, the _strindices builtin in jq\u0027s src/builtin.c passes its arguments directly to jv_string_indexes() without verifying they are strings, and jv_string_indexes() in src/jv.c relies solely on assert() checks that are stripped in release builds compiled with -DNDEBUG. This allows an attacker to crash jq trivially with input like _strindices(0), and by crafting a numeric value whose IEEE-754 bit pattern maps to a chosen pointer, achieve a controlled pointer dereference and limited memory read/probe primitive. Any deployment that evaluates untrusted jq filters against a release build is vulnerable. This issue has been patched in commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03, which is part of version 1.8.2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39956",
"url": "https://www.suse.com/security/cve/CVE-2026-39956"
},
{
"category": "external",
"summary": "SUSE Bug 1262070 for CVE-2026-39956",
"url": "https://bugzilla.suse.com/1262070"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-07T12:32:43Z",
"details": "moderate"
}
],
"title": "CVE-2026-39956"
},
{
"cve": "CVE-2026-39979",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39979"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39979",
"url": "https://www.suse.com/security/cve/CVE-2026-39979"
},
{
"category": "external",
"summary": "SUSE Bug 1262071 for CVE-2026-39979",
"url": "https://bugzilla.suse.com/1262071"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-07T12:32:43Z",
"details": "moderate"
}
],
"title": "CVE-2026-39979"
},
{
"cve": "CVE-2026-40164",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-40164"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n), turning any jq expression into an O(n) operation and causing significant CPU exhaustion. This affected common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more practical to exploit than existing heap overflow issues since it required only a small payload. This issue has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-40164",
"url": "https://www.suse.com/security/cve/CVE-2026-40164"
},
{
"category": "external",
"summary": "SUSE Bug 1262072 for CVE-2026-40164",
"url": "https://bugzilla.suse.com/1262072"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-07T12:32:43Z",
"details": "moderate"
}
],
"title": "CVE-2026-40164"
},
{
"cve": "CVE-2026-40612",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-40612"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since the JSON parser caps at depth 10000), the C stack is exhausted.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-40612",
"url": "https://www.suse.com/security/cve/CVE-2026-40612"
},
{
"category": "external",
"summary": "SUSE Bug 1265060 for CVE-2026-40612",
"url": "https://bugzilla.suse.com/1265060"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-07T12:32:43Z",
"details": "moderate"
}
],
"title": "CVE-2026-40612"
},
{
"cve": "CVE-2026-41256",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41256"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \\x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41256",
"url": "https://www.suse.com/security/cve/CVE-2026-41256"
},
{
"category": "external",
"summary": "SUSE Bug 1265061 for CVE-2026-41256",
"url": "https://bugzilla.suse.com/1265061"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-07T12:32:43Z",
"details": "moderate"
}
],
"title": "CVE-2026-41256"
},
{
"cve": "CVE-2026-41257",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41257"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM\u0027s data stack tracks its allocation size in a signed int. When the stack grows beyond ~1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41257",
"url": "https://www.suse.com/security/cve/CVE-2026-41257"
},
{
"category": "external",
"summary": "SUSE Bug 1265062 for CVE-2026-41257",
"url": "https://bugzilla.suse.com/1265062"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-07T12:32:43Z",
"details": "important"
}
],
"title": "CVE-2026-41257"
},
{
"cve": "CVE-2026-43894",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-43894"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack buffer, and then writes ~715 million 16-bit units (~1.4 GiB) at an offset 1.43 GiB below the stack frame. The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-43894",
"url": "https://www.suse.com/security/cve/CVE-2026-43894"
},
{
"category": "external",
"summary": "SUSE Bug 1265070 for CVE-2026-43894",
"url": "https://bugzilla.suse.com/1265070"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-07T12:32:43Z",
"details": "important"
}
],
"title": "CVE-2026-43894"
}
]
}
SUSE-SU-2026:22566-1
Vulnerability from csaf_suse - Published: 2026-07-07 12:32 - Updated: 2026-09-14 16:11Summary
Security update for jq
Severity
Important
Notes
Title of the patch: Security update for jq
Description of the patch: This update for jq fixes the following issues:
- CVE-2025-48060: improper handling of string data in `jv_string_empty` can lead to heap buffer overflow and a crash
when processing crafted input (bsc#1244116).
- CVE-2026-32316: integer overflow within the `jvp_string_append()` and `jvp_string_copy_replace_bad` functions can
lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).
- CVE-2026-33947: unbounded recursion in functions `jv_setpath()`, `jv_getpath()`, and `delpaths_sorted()` can lead to
excessive resource consumption when processing crafted JSON input (bsc#1262069).
- CVE-2026-39956: missing runtime type checks in `_strindices` and `jv_string_indexes()` can lead to a crash when
evaluating untrusted jq filters against a release build (bsc#1262070).
- CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in `jv_parse_sized` can lead to an
out-of-bounds read when processing malformed JSON (bsc#1262071).
- CVE-2026-40164: use of `MurmurHash3` with a hardcoded seed allows pre-computation of key collisions and can lead to a
denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).
- CVE-2026-40612: recursion into nested arrays/objects with no depth limit in `jv_contains` can lead to a C stack
exhaustion when processing crafted input (bsc#1265060).
- CVE-2026-41256: truncation of top-level jq programs loaded with `-f` and can lead to the execution of unintended
programs (bsc#1265061).
- CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS when processing jq
bytecode (bsc#1265062).
- CVE-2026-43894: signed integer overflow in the `decNumberFromString` `D2U()` macro can lead to an out-of-bounds
memory write when processing large number literals (bsc#1265070).
- CVE-2026-33948: improper handling of buffer sizes via `strlen()` instead of `fgets()` in CLI input parsing allows
validation bypass via embedded NUL bytes (bsc#1262043).
Patchnames: SUSE-SLES-16.0-1169
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.3 (Medium)
Affected products
Recommended
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.8 (Medium)
Affected products
Recommended
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.1 (Medium)
Affected products
Recommended
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.6 (Medium)
Affected products
Recommended
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.8 (High)
Affected products
Recommended
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
49 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for jq",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for jq fixes the following issues:\n\n- CVE-2025-48060: improper handling of string data in `jv_string_empty` can lead to heap buffer overflow and a crash\n when processing crafted input (bsc#1244116).\n- CVE-2026-32316: integer overflow within the `jvp_string_append()` and `jvp_string_copy_replace_bad` functions can\n lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).\n- CVE-2026-33947: unbounded recursion in functions `jv_setpath()`, `jv_getpath()`, and `delpaths_sorted()` can lead to\n excessive resource consumption when processing crafted JSON input (bsc#1262069).\n- CVE-2026-39956: missing runtime type checks in `_strindices` and `jv_string_indexes()` can lead to a crash when\n evaluating untrusted jq filters against a release build (bsc#1262070).\n- CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in `jv_parse_sized` can lead to an\n out-of-bounds read when processing malformed JSON (bsc#1262071).\n- CVE-2026-40164: use of `MurmurHash3` with a hardcoded seed allows pre-computation of key collisions and can lead to a\n denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).\n- CVE-2026-40612: recursion into nested arrays/objects with no depth limit in `jv_contains` can lead to a C stack\n exhaustion when processing crafted input (bsc#1265060).\n- CVE-2026-41256: truncation of top-level jq programs loaded with `-f` and can lead to the execution of unintended\n programs (bsc#1265061).\n- CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS when processing jq\n bytecode (bsc#1265062).\n- CVE-2026-43894: signed integer overflow in the `decNumberFromString` `D2U()` macro can lead to an out-of-bounds\n memory write when processing large number literals (bsc#1265070).\n- CVE-2026-33948: improper handling of buffer sizes via `strlen()` instead of `fgets()` in CLI input parsing allows\n validation bypass via embedded NUL bytes (bsc#1262043).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLES-16.0-1169",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22566-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22566-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622566-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22566-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-July/048203.html"
},
{
"category": "self",
"summary": "SUSE Bug 1244116",
"url": "https://bugzilla.suse.com/1244116"
},
{
"category": "self",
"summary": "SUSE Bug 1262043",
"url": "https://bugzilla.suse.com/1262043"
},
{
"category": "self",
"summary": "SUSE Bug 1262044",
"url": "https://bugzilla.suse.com/1262044"
},
{
"category": "self",
"summary": "SUSE Bug 1262069",
"url": "https://bugzilla.suse.com/1262069"
},
{
"category": "self",
"summary": "SUSE Bug 1262070",
"url": "https://bugzilla.suse.com/1262070"
},
{
"category": "self",
"summary": "SUSE Bug 1262071",
"url": "https://bugzilla.suse.com/1262071"
},
{
"category": "self",
"summary": "SUSE Bug 1262072",
"url": "https://bugzilla.suse.com/1262072"
},
{
"category": "self",
"summary": "SUSE Bug 1265060",
"url": "https://bugzilla.suse.com/1265060"
},
{
"category": "self",
"summary": "SUSE Bug 1265061",
"url": "https://bugzilla.suse.com/1265061"
},
{
"category": "self",
"summary": "SUSE Bug 1265062",
"url": "https://bugzilla.suse.com/1265062"
},
{
"category": "self",
"summary": "SUSE Bug 1265070",
"url": "https://bugzilla.suse.com/1265070"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-48060 page",
"url": "https://www.suse.com/security/cve/CVE-2025-48060/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-32316 page",
"url": "https://www.suse.com/security/cve/CVE-2026-32316/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33947 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33947/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33948 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33948/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39956 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39956/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39979 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39979/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-40164 page",
"url": "https://www.suse.com/security/cve/CVE-2026-40164/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-40612 page",
"url": "https://www.suse.com/security/cve/CVE-2026-40612/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41256 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41256/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41257 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41257/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-43894 page",
"url": "https://www.suse.com/security/cve/CVE-2026-43894/"
}
],
"title": "Security update for jq",
"tracking": {
"current_release_date": "2026-09-14T16:11:46Z",
"generator": {
"date": "2026-07-07T12:32:43Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22566-1",
"initial_release_date": "2026-07-07T12:32:43Z",
"revision_history": [
{
"date": "2026-07-07T12:32:43Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-14T16:11:46Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "jq-1.7.1-160000.3.1.aarch64",
"product": {
"name": "jq-1.7.1-160000.3.1.aarch64",
"product_id": "jq-1.7.1-160000.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "libjq-devel-1.7.1-160000.3.1.aarch64",
"product": {
"name": "libjq-devel-1.7.1-160000.3.1.aarch64",
"product_id": "libjq-devel-1.7.1-160000.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "libjq1-1.7.1-160000.3.1.aarch64",
"product": {
"name": "libjq1-1.7.1-160000.3.1.aarch64",
"product_id": "libjq1-1.7.1-160000.3.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "jq-1.7.1-160000.3.1.ppc64le",
"product": {
"name": "jq-1.7.1-160000.3.1.ppc64le",
"product_id": "jq-1.7.1-160000.3.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libjq-devel-1.7.1-160000.3.1.ppc64le",
"product": {
"name": "libjq-devel-1.7.1-160000.3.1.ppc64le",
"product_id": "libjq-devel-1.7.1-160000.3.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libjq1-1.7.1-160000.3.1.ppc64le",
"product": {
"name": "libjq1-1.7.1-160000.3.1.ppc64le",
"product_id": "libjq1-1.7.1-160000.3.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "jq-1.7.1-160000.3.1.s390x",
"product": {
"name": "jq-1.7.1-160000.3.1.s390x",
"product_id": "jq-1.7.1-160000.3.1.s390x"
}
},
{
"category": "product_version",
"name": "libjq-devel-1.7.1-160000.3.1.s390x",
"product": {
"name": "libjq-devel-1.7.1-160000.3.1.s390x",
"product_id": "libjq-devel-1.7.1-160000.3.1.s390x"
}
},
{
"category": "product_version",
"name": "libjq1-1.7.1-160000.3.1.s390x",
"product": {
"name": "libjq1-1.7.1-160000.3.1.s390x",
"product_id": "libjq1-1.7.1-160000.3.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "jq-1.7.1-160000.3.1.x86_64",
"product": {
"name": "jq-1.7.1-160000.3.1.x86_64",
"product_id": "jq-1.7.1-160000.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "libjq-devel-1.7.1-160000.3.1.x86_64",
"product": {
"name": "libjq-devel-1.7.1-160000.3.1.x86_64",
"product_id": "libjq-devel-1.7.1-160000.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "libjq1-1.7.1-160000.3.1.x86_64",
"product": {
"name": "libjq1-1.7.1-160000.3.1.x86_64",
"product_id": "libjq1-1.7.1-160000.3.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-1.7.1-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64"
},
"product_reference": "jq-1.7.1-160000.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-1.7.1-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le"
},
"product_reference": "jq-1.7.1-160000.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-1.7.1-160000.3.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x"
},
"product_reference": "jq-1.7.1-160000.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-1.7.1-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64"
},
"product_reference": "jq-1.7.1-160000.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq-devel-1.7.1-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64"
},
"product_reference": "libjq-devel-1.7.1-160000.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq-devel-1.7.1-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le"
},
"product_reference": "libjq-devel-1.7.1-160000.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq-devel-1.7.1-160000.3.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x"
},
"product_reference": "libjq-devel-1.7.1-160000.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq-devel-1.7.1-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64"
},
"product_reference": "libjq-devel-1.7.1-160000.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq1-1.7.1-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64"
},
"product_reference": "libjq1-1.7.1-160000.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq1-1.7.1-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le"
},
"product_reference": "libjq1-1.7.1-160000.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq1-1.7.1-160000.3.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x"
},
"product_reference": "libjq1-1.7.1-160000.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq1-1.7.1-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64"
},
"product_reference": "libjq1-1.7.1-160000.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-1.7.1-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64"
},
"product_reference": "jq-1.7.1-160000.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-1.7.1-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le"
},
"product_reference": "jq-1.7.1-160000.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-1.7.1-160000.3.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x"
},
"product_reference": "jq-1.7.1-160000.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-1.7.1-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64"
},
"product_reference": "jq-1.7.1-160000.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq-devel-1.7.1-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64"
},
"product_reference": "libjq-devel-1.7.1-160000.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq-devel-1.7.1-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le"
},
"product_reference": "libjq-devel-1.7.1-160000.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq-devel-1.7.1-160000.3.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x"
},
"product_reference": "libjq-devel-1.7.1-160000.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq-devel-1.7.1-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64"
},
"product_reference": "libjq-devel-1.7.1-160000.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq1-1.7.1-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64"
},
"product_reference": "libjq1-1.7.1-160000.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq1-1.7.1-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le"
},
"product_reference": "libjq1-1.7.1-160000.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq1-1.7.1-160000.3.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x"
},
"product_reference": "libjq1-1.7.1-160000.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq1-1.7.1-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
},
"product_reference": "libjq1-1.7.1-160000.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-48060",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-48060"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 `void* p = malloc(sz);`. As of time of publication, no patched versions are available.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-48060",
"url": "https://www.suse.com/security/cve/CVE-2025-48060"
},
{
"category": "external",
"summary": "SUSE Bug 1244116 for CVE-2025-48060",
"url": "https://bugzilla.suse.com/1244116"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-07T12:32:43Z",
"details": "moderate"
}
],
"title": "CVE-2025-48060"
},
{
"cve": "CVE-2026-32316",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-32316"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-32316",
"url": "https://www.suse.com/security/cve/CVE-2026-32316"
},
{
"category": "external",
"summary": "SUSE Bug 1262044 for CVE-2026-32316",
"url": "https://bugzilla.suse.com/1262044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-07T12:32:43Z",
"details": "moderate"
}
],
"title": "CVE-2026-32316"
},
{
"cve": "CVE-2026-33947",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33947"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(), and delpaths_sorted() in jq\u0027s src/jv_aux.c use unbounded recursion whose depth is controlled by the length of a caller-supplied path array, with no depth limit enforced. An attacker can supply a JSON document containing a flat array of ~65,000 integers (~200 KB) that, when used as a path argument by a trusted jq filter, exhausts the C call stack and crashes the process with a segmentation fault (SIGSEGV). This bypass works because the existing MAX_PARSING_DEPTH (10,000) limit only protects the JSON parser, not runtime path operations where arrays can be programmatically constructed to arbitrary lengths. The impact is denial of service (unrecoverable crash) affecting any application or service that processes untrusted JSON input through jq\u0027s setpath, getpath, or delpaths builtins. This issue has been addressed in commit fb59f1491058d58bdc3e8dd28f1773d1ac690a1f.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33947",
"url": "https://www.suse.com/security/cve/CVE-2026-33947"
},
{
"category": "external",
"summary": "SUSE Bug 1262069 for CVE-2026-33947",
"url": "https://bugzilla.suse.com/1262069"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-07T12:32:43Z",
"details": "moderate"
}
],
"title": "CVE-2026-33947"
},
{
"cve": "CVE-2026-33948",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33948"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33948",
"url": "https://www.suse.com/security/cve/CVE-2026-33948"
},
{
"category": "external",
"summary": "SUSE Bug 1262043 for CVE-2026-33948",
"url": "https://bugzilla.suse.com/1262043"
},
{
"category": "external",
"summary": "SUSE Bug 1265061 for CVE-2026-33948",
"url": "https://bugzilla.suse.com/1265061"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-07T12:32:43Z",
"details": "moderate"
}
],
"title": "CVE-2026-33948"
},
{
"cve": "CVE-2026-39956",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39956"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. Prior to version 1.8.2, the _strindices builtin in jq\u0027s src/builtin.c passes its arguments directly to jv_string_indexes() without verifying they are strings, and jv_string_indexes() in src/jv.c relies solely on assert() checks that are stripped in release builds compiled with -DNDEBUG. This allows an attacker to crash jq trivially with input like _strindices(0), and by crafting a numeric value whose IEEE-754 bit pattern maps to a chosen pointer, achieve a controlled pointer dereference and limited memory read/probe primitive. Any deployment that evaluates untrusted jq filters against a release build is vulnerable. This issue has been patched in commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03, which is part of version 1.8.2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39956",
"url": "https://www.suse.com/security/cve/CVE-2026-39956"
},
{
"category": "external",
"summary": "SUSE Bug 1262070 for CVE-2026-39956",
"url": "https://bugzilla.suse.com/1262070"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-07T12:32:43Z",
"details": "moderate"
}
],
"title": "CVE-2026-39956"
},
{
"cve": "CVE-2026-39979",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39979"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39979",
"url": "https://www.suse.com/security/cve/CVE-2026-39979"
},
{
"category": "external",
"summary": "SUSE Bug 1262071 for CVE-2026-39979",
"url": "https://bugzilla.suse.com/1262071"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-07T12:32:43Z",
"details": "moderate"
}
],
"title": "CVE-2026-39979"
},
{
"cve": "CVE-2026-40164",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-40164"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n), turning any jq expression into an O(n) operation and causing significant CPU exhaustion. This affected common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more practical to exploit than existing heap overflow issues since it required only a small payload. This issue has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-40164",
"url": "https://www.suse.com/security/cve/CVE-2026-40164"
},
{
"category": "external",
"summary": "SUSE Bug 1262072 for CVE-2026-40164",
"url": "https://bugzilla.suse.com/1262072"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-07T12:32:43Z",
"details": "moderate"
}
],
"title": "CVE-2026-40164"
},
{
"cve": "CVE-2026-40612",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-40612"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since the JSON parser caps at depth 10000), the C stack is exhausted.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-40612",
"url": "https://www.suse.com/security/cve/CVE-2026-40612"
},
{
"category": "external",
"summary": "SUSE Bug 1265060 for CVE-2026-40612",
"url": "https://bugzilla.suse.com/1265060"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-07T12:32:43Z",
"details": "moderate"
}
],
"title": "CVE-2026-40612"
},
{
"cve": "CVE-2026-41256",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41256"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \\x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41256",
"url": "https://www.suse.com/security/cve/CVE-2026-41256"
},
{
"category": "external",
"summary": "SUSE Bug 1265061 for CVE-2026-41256",
"url": "https://bugzilla.suse.com/1265061"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-07T12:32:43Z",
"details": "moderate"
}
],
"title": "CVE-2026-41256"
},
{
"cve": "CVE-2026-41257",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41257"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM\u0027s data stack tracks its allocation size in a signed int. When the stack grows beyond ~1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41257",
"url": "https://www.suse.com/security/cve/CVE-2026-41257"
},
{
"category": "external",
"summary": "SUSE Bug 1265062 for CVE-2026-41257",
"url": "https://bugzilla.suse.com/1265062"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-07T12:32:43Z",
"details": "important"
}
],
"title": "CVE-2026-41257"
},
{
"cve": "CVE-2026-43894",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-43894"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack buffer, and then writes ~715 million 16-bit units (~1.4 GiB) at an offset 1.43 GiB below the stack frame. The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-43894",
"url": "https://www.suse.com/security/cve/CVE-2026-43894"
},
{
"category": "external",
"summary": "SUSE Bug 1265070 for CVE-2026-43894",
"url": "https://bugzilla.suse.com/1265070"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libjq1-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:jq-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq-devel-1.7.1-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libjq1-1.7.1-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-07T12:32:43Z",
"details": "important"
}
],
"title": "CVE-2026-43894"
}
]
}
SUSE-SU-2026:22664-1
Vulnerability from csaf_suse - Published: 2026-07-03 12:17 - Updated: 2026-09-14 16:11Summary
Security update for jq
Severity
Important
Notes
Title of the patch: Security update for jq
Description of the patch: This update for jq fixes the following issues:
- CVE-2026-32316: integer overflow within the `jvp_string_append()` and `jvp_string_copy_replace_bad` functions can
lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).
- CVE-2026-33947: unbounded recursion in functions `jv_setpath()`, `jv_getpath()`, and `delpaths_sorted()` can lead to
excessive resource consumption when processing crafted JSON input (bsc#1262069).
- CVE-2026-39956: missing runtime type checks in `_strindices` and `jv_string_indexes()` can lead to a crash when
evaluating untrusted jq filters against a release build (bsc#1262070).
- CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in `jv_parse_sized` can lead to an
out-of-bounds read when processing malformed JSON (bsc#1262071).
- CVE-2026-40164: use of `MurmurHash3` with a hardcoded seed allows pre-computation of key collisions and can lead to a
denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).
- CVE-2026-40612: recursion into nested arrays/objects with no depth limit in `jv_contains` can lead to a C stack
exhaustion when processing crafted input (bsc#1265060).
- CVE-2026-41256: truncation of top-level jq programs loaded with `-f` and can lead to the execution of unintended
programs (bsc#1265061).
- CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS when processing jq
bytecode (bsc#1265062).
- CVE-2026-43894: signed integer overflow in the `decNumberFromString` `D2U()` macro can lead to an out-of-bounds
memory write when processing large number literals (bsc#1265070).
- CVE-2026-33948: improper handling of buffer sizes via `strlen()` instead of `fgets()` in CLI input parsing allows
validation bypass via embedded NUL bytes (bsc#1262043).
Patchnames: SUSE-SLE-Micro-6.1-610
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
6.8 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.1 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.6 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.8 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
45 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for jq",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for jq fixes the following issues:\n\n- CVE-2026-32316: integer overflow within the `jvp_string_append()` and `jvp_string_copy_replace_bad` functions can\n lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).\n- CVE-2026-33947: unbounded recursion in functions `jv_setpath()`, `jv_getpath()`, and `delpaths_sorted()` can lead to\n excessive resource consumption when processing crafted JSON input (bsc#1262069).\n- CVE-2026-39956: missing runtime type checks in `_strindices` and `jv_string_indexes()` can lead to a crash when\n evaluating untrusted jq filters against a release build (bsc#1262070).\n- CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in `jv_parse_sized` can lead to an\n out-of-bounds read when processing malformed JSON (bsc#1262071).\n- CVE-2026-40164: use of `MurmurHash3` with a hardcoded seed allows pre-computation of key collisions and can lead to a\n denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).\n- CVE-2026-40612: recursion into nested arrays/objects with no depth limit in `jv_contains` can lead to a C stack\n exhaustion when processing crafted input (bsc#1265060).\n- CVE-2026-41256: truncation of top-level jq programs loaded with `-f` and can lead to the execution of unintended\n programs (bsc#1265061).\n- CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS when processing jq\n bytecode (bsc#1265062).\n- CVE-2026-43894: signed integer overflow in the `decNumberFromString` `D2U()` macro can lead to an out-of-bounds\n memory write when processing large number literals (bsc#1265070).\n- CVE-2026-33948: improper handling of buffer sizes via `strlen()` instead of `fgets()` in CLI input parsing allows\n validation bypass via embedded NUL bytes (bsc#1262043).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.1-610",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22664-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22664-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622664-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22664-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027661.html"
},
{
"category": "self",
"summary": "SUSE Bug 1262043",
"url": "https://bugzilla.suse.com/1262043"
},
{
"category": "self",
"summary": "SUSE Bug 1262044",
"url": "https://bugzilla.suse.com/1262044"
},
{
"category": "self",
"summary": "SUSE Bug 1262069",
"url": "https://bugzilla.suse.com/1262069"
},
{
"category": "self",
"summary": "SUSE Bug 1262070",
"url": "https://bugzilla.suse.com/1262070"
},
{
"category": "self",
"summary": "SUSE Bug 1262071",
"url": "https://bugzilla.suse.com/1262071"
},
{
"category": "self",
"summary": "SUSE Bug 1262072",
"url": "https://bugzilla.suse.com/1262072"
},
{
"category": "self",
"summary": "SUSE Bug 1265060",
"url": "https://bugzilla.suse.com/1265060"
},
{
"category": "self",
"summary": "SUSE Bug 1265061",
"url": "https://bugzilla.suse.com/1265061"
},
{
"category": "self",
"summary": "SUSE Bug 1265062",
"url": "https://bugzilla.suse.com/1265062"
},
{
"category": "self",
"summary": "SUSE Bug 1265070",
"url": "https://bugzilla.suse.com/1265070"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-32316 page",
"url": "https://www.suse.com/security/cve/CVE-2026-32316/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33947 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33947/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33948 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33948/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39956 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39956/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39979 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39979/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-40164 page",
"url": "https://www.suse.com/security/cve/CVE-2026-40164/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-40612 page",
"url": "https://www.suse.com/security/cve/CVE-2026-40612/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41256 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41256/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41257 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41257/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-43894 page",
"url": "https://www.suse.com/security/cve/CVE-2026-43894/"
}
],
"title": "Security update for jq",
"tracking": {
"current_release_date": "2026-09-14T16:11:47Z",
"generator": {
"date": "2026-07-03T12:17:50Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22664-1",
"initial_release_date": "2026-07-03T12:17:50Z",
"revision_history": [
{
"date": "2026-07-03T12:17:50Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-14T16:11:47Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "jq-1.7.1-slfo.1.1_3.1.aarch64",
"product": {
"name": "jq-1.7.1-slfo.1.1_3.1.aarch64",
"product_id": "jq-1.7.1-slfo.1.1_3.1.aarch64"
}
},
{
"category": "product_version",
"name": "libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"product": {
"name": "libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"product_id": "libjq1-1.7.1-slfo.1.1_3.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "jq-1.7.1-slfo.1.1_3.1.ppc64le",
"product": {
"name": "jq-1.7.1-slfo.1.1_3.1.ppc64le",
"product_id": "jq-1.7.1-slfo.1.1_3.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"product": {
"name": "libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"product_id": "libjq1-1.7.1-slfo.1.1_3.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "jq-1.7.1-slfo.1.1_3.1.s390x",
"product": {
"name": "jq-1.7.1-slfo.1.1_3.1.s390x",
"product_id": "jq-1.7.1-slfo.1.1_3.1.s390x"
}
},
{
"category": "product_version",
"name": "libjq1-1.7.1-slfo.1.1_3.1.s390x",
"product": {
"name": "libjq1-1.7.1-slfo.1.1_3.1.s390x",
"product_id": "libjq1-1.7.1-slfo.1.1_3.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "jq-1.7.1-slfo.1.1_3.1.x86_64",
"product": {
"name": "jq-1.7.1-slfo.1.1_3.1.x86_64",
"product_id": "jq-1.7.1-slfo.1.1_3.1.x86_64"
}
},
{
"category": "product_version",
"name": "libjq1-1.7.1-slfo.1.1_3.1.x86_64",
"product": {
"name": "libjq1-1.7.1-slfo.1.1_3.1.x86_64",
"product_id": "libjq1-1.7.1-slfo.1.1_3.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.1",
"product": {
"name": "SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.1"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-1.7.1-slfo.1.1_3.1.aarch64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64"
},
"product_reference": "jq-1.7.1-slfo.1.1_3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-1.7.1-slfo.1.1_3.1.ppc64le as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le"
},
"product_reference": "jq-1.7.1-slfo.1.1_3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-1.7.1-slfo.1.1_3.1.s390x as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x"
},
"product_reference": "jq-1.7.1-slfo.1.1_3.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-1.7.1-slfo.1.1_3.1.x86_64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64"
},
"product_reference": "jq-1.7.1-slfo.1.1_3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq1-1.7.1-slfo.1.1_3.1.aarch64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64"
},
"product_reference": "libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq1-1.7.1-slfo.1.1_3.1.ppc64le as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le"
},
"product_reference": "libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq1-1.7.1-slfo.1.1_3.1.s390x as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x"
},
"product_reference": "libjq1-1.7.1-slfo.1.1_3.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq1-1.7.1-slfo.1.1_3.1.x86_64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
},
"product_reference": "libjq1-1.7.1-slfo.1.1_3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-32316",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-32316"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-32316",
"url": "https://www.suse.com/security/cve/CVE-2026-32316"
},
{
"category": "external",
"summary": "SUSE Bug 1262044 for CVE-2026-32316",
"url": "https://bugzilla.suse.com/1262044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-03T12:17:50Z",
"details": "moderate"
}
],
"title": "CVE-2026-32316"
},
{
"cve": "CVE-2026-33947",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33947"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(), and delpaths_sorted() in jq\u0027s src/jv_aux.c use unbounded recursion whose depth is controlled by the length of a caller-supplied path array, with no depth limit enforced. An attacker can supply a JSON document containing a flat array of ~65,000 integers (~200 KB) that, when used as a path argument by a trusted jq filter, exhausts the C call stack and crashes the process with a segmentation fault (SIGSEGV). This bypass works because the existing MAX_PARSING_DEPTH (10,000) limit only protects the JSON parser, not runtime path operations where arrays can be programmatically constructed to arbitrary lengths. The impact is denial of service (unrecoverable crash) affecting any application or service that processes untrusted JSON input through jq\u0027s setpath, getpath, or delpaths builtins. This issue has been addressed in commit fb59f1491058d58bdc3e8dd28f1773d1ac690a1f.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33947",
"url": "https://www.suse.com/security/cve/CVE-2026-33947"
},
{
"category": "external",
"summary": "SUSE Bug 1262069 for CVE-2026-33947",
"url": "https://bugzilla.suse.com/1262069"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-03T12:17:50Z",
"details": "moderate"
}
],
"title": "CVE-2026-33947"
},
{
"cve": "CVE-2026-33948",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33948"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33948",
"url": "https://www.suse.com/security/cve/CVE-2026-33948"
},
{
"category": "external",
"summary": "SUSE Bug 1262043 for CVE-2026-33948",
"url": "https://bugzilla.suse.com/1262043"
},
{
"category": "external",
"summary": "SUSE Bug 1265061 for CVE-2026-33948",
"url": "https://bugzilla.suse.com/1265061"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-03T12:17:50Z",
"details": "moderate"
}
],
"title": "CVE-2026-33948"
},
{
"cve": "CVE-2026-39956",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39956"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. Prior to version 1.8.2, the _strindices builtin in jq\u0027s src/builtin.c passes its arguments directly to jv_string_indexes() without verifying they are strings, and jv_string_indexes() in src/jv.c relies solely on assert() checks that are stripped in release builds compiled with -DNDEBUG. This allows an attacker to crash jq trivially with input like _strindices(0), and by crafting a numeric value whose IEEE-754 bit pattern maps to a chosen pointer, achieve a controlled pointer dereference and limited memory read/probe primitive. Any deployment that evaluates untrusted jq filters against a release build is vulnerable. This issue has been patched in commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03, which is part of version 1.8.2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39956",
"url": "https://www.suse.com/security/cve/CVE-2026-39956"
},
{
"category": "external",
"summary": "SUSE Bug 1262070 for CVE-2026-39956",
"url": "https://bugzilla.suse.com/1262070"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-03T12:17:50Z",
"details": "moderate"
}
],
"title": "CVE-2026-39956"
},
{
"cve": "CVE-2026-39979",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39979"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39979",
"url": "https://www.suse.com/security/cve/CVE-2026-39979"
},
{
"category": "external",
"summary": "SUSE Bug 1262071 for CVE-2026-39979",
"url": "https://bugzilla.suse.com/1262071"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-03T12:17:50Z",
"details": "moderate"
}
],
"title": "CVE-2026-39979"
},
{
"cve": "CVE-2026-40164",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-40164"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n), turning any jq expression into an O(n) operation and causing significant CPU exhaustion. This affected common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more practical to exploit than existing heap overflow issues since it required only a small payload. This issue has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-40164",
"url": "https://www.suse.com/security/cve/CVE-2026-40164"
},
{
"category": "external",
"summary": "SUSE Bug 1262072 for CVE-2026-40164",
"url": "https://bugzilla.suse.com/1262072"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-03T12:17:50Z",
"details": "moderate"
}
],
"title": "CVE-2026-40164"
},
{
"cve": "CVE-2026-40612",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-40612"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since the JSON parser caps at depth 10000), the C stack is exhausted.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-40612",
"url": "https://www.suse.com/security/cve/CVE-2026-40612"
},
{
"category": "external",
"summary": "SUSE Bug 1265060 for CVE-2026-40612",
"url": "https://bugzilla.suse.com/1265060"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-03T12:17:50Z",
"details": "moderate"
}
],
"title": "CVE-2026-40612"
},
{
"cve": "CVE-2026-41256",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41256"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \\x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41256",
"url": "https://www.suse.com/security/cve/CVE-2026-41256"
},
{
"category": "external",
"summary": "SUSE Bug 1265061 for CVE-2026-41256",
"url": "https://bugzilla.suse.com/1265061"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-03T12:17:50Z",
"details": "moderate"
}
],
"title": "CVE-2026-41256"
},
{
"cve": "CVE-2026-41257",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41257"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM\u0027s data stack tracks its allocation size in a signed int. When the stack grows beyond ~1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41257",
"url": "https://www.suse.com/security/cve/CVE-2026-41257"
},
{
"category": "external",
"summary": "SUSE Bug 1265062 for CVE-2026-41257",
"url": "https://bugzilla.suse.com/1265062"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-03T12:17:50Z",
"details": "important"
}
],
"title": "CVE-2026-41257"
},
{
"cve": "CVE-2026-43894",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-43894"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack buffer, and then writes ~715 million 16-bit units (~1.4 GiB) at an offset 1.43 GiB below the stack frame. The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-43894",
"url": "https://www.suse.com/security/cve/CVE-2026-43894"
},
{
"category": "external",
"summary": "SUSE Bug 1265070 for CVE-2026-43894",
"url": "https://bugzilla.suse.com/1265070"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:jq-1.7.1-slfo.1.1_3.1.x86_64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.aarch64",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.ppc64le",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.s390x",
"SUSE Linux Micro 6.1:libjq1-1.7.1-slfo.1.1_3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-03T12:17:50Z",
"details": "important"
}
],
"title": "CVE-2026-43894"
}
]
}
SUSE-SU-2026:22705-1
Vulnerability from csaf_suse - Published: 2026-07-08 11:04 - Updated: 2026-09-14 16:11Summary
Security update for jq
Severity
Moderate
Notes
Title of the patch: Security update for jq
Description of the patch: This update for jq fixes the following issues
Security issues fixed:
- CVE-2025-9403: reacheable assertion in `run_jq_tests` can lead to program termination when processing malformed JSON
input containing invalid Unicode escape sequences (bsc#1248600).
- CVE-2026-32316: integer overflow within the `jvp_string_append()` and `jvp_string_copy_replace_bad` functions can
lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).
- CVE-2026-33947: unbounded recursion in functions `jv_setpath()`, `jv_getpath()`, and `delpaths_sorted()` can lead to
excessive resource consumption when processing crafted JSON input (bsc#1262069).
- CVE-2026-33948: improper handling of buffer sizes via `strlen()` instead of `fgets()` in CLI input parsing allows
validation bypass via embedded NUL bytes (bsc#1262043).
- CVE-2026-39956: missing runtime type checks in `_strindices` and `jv_string_indexes()` can lead to a crash when
evaluating untrusted jq filters against a release build (bsc#1262070).
- CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in `jv_parse_sized` can lead to an
out-of-bounds read when processing malformed JSON (bsc#1262071).
- CVE-2026-40164: use of `MurmurHash3` with a hardcoded seed allows pre-computation of key collisions and can lead to a
denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).
Other updates and bugfixes:
- spec: add `--enable-pthread-tls` to configure invocation.
Patchnames: SUSE-SLE-Micro-6.0-788
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:jq-1.6-6.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
low
6.8 (Medium)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:jq-1.6-6.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:jq-1.6-6.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:jq-1.6-6.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:jq-1.6-6.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.1 (Medium)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:jq-1.6-6.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.5 (Medium)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:jq-1.6-6.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
References
33 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for jq",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for jq fixes the following issues\n\nSecurity issues fixed:\n\n- CVE-2025-9403: reacheable assertion in `run_jq_tests` can lead to program termination when processing malformed JSON\n input containing invalid Unicode escape sequences (bsc#1248600).\n- CVE-2026-32316: integer overflow within the `jvp_string_append()` and `jvp_string_copy_replace_bad` functions can\n lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).\n- CVE-2026-33947: unbounded recursion in functions `jv_setpath()`, `jv_getpath()`, and `delpaths_sorted()` can lead to\n excessive resource consumption when processing crafted JSON input (bsc#1262069).\n- CVE-2026-33948: improper handling of buffer sizes via `strlen()` instead of `fgets()` in CLI input parsing allows\n validation bypass via embedded NUL bytes (bsc#1262043).\n- CVE-2026-39956: missing runtime type checks in `_strindices` and `jv_string_indexes()` can lead to a crash when\n evaluating untrusted jq filters against a release build (bsc#1262070).\n- CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in `jv_parse_sized` can lead to an\n out-of-bounds read when processing malformed JSON (bsc#1262071).\n- CVE-2026-40164: use of `MurmurHash3` with a hardcoded seed allows pre-computation of key collisions and can lead to a\n denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).\n\nOther updates and bugfixes:\n\n- spec: add `--enable-pthread-tls` to configure invocation.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.0-788",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22705-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22705-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622705-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22705-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027727.html"
},
{
"category": "self",
"summary": "SUSE Bug 1248600",
"url": "https://bugzilla.suse.com/1248600"
},
{
"category": "self",
"summary": "SUSE Bug 1262043",
"url": "https://bugzilla.suse.com/1262043"
},
{
"category": "self",
"summary": "SUSE Bug 1262044",
"url": "https://bugzilla.suse.com/1262044"
},
{
"category": "self",
"summary": "SUSE Bug 1262069",
"url": "https://bugzilla.suse.com/1262069"
},
{
"category": "self",
"summary": "SUSE Bug 1262070",
"url": "https://bugzilla.suse.com/1262070"
},
{
"category": "self",
"summary": "SUSE Bug 1262071",
"url": "https://bugzilla.suse.com/1262071"
},
{
"category": "self",
"summary": "SUSE Bug 1262072",
"url": "https://bugzilla.suse.com/1262072"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-9403 page",
"url": "https://www.suse.com/security/cve/CVE-2025-9403/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-32316 page",
"url": "https://www.suse.com/security/cve/CVE-2026-32316/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33947 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33947/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33948 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33948/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39956 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39956/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39979 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39979/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-40164 page",
"url": "https://www.suse.com/security/cve/CVE-2026-40164/"
}
],
"title": "Security update for jq",
"tracking": {
"current_release_date": "2026-09-14T16:11:48Z",
"generator": {
"date": "2026-07-08T11:04:31Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22705-1",
"initial_release_date": "2026-07-08T11:04:31Z",
"revision_history": [
{
"date": "2026-07-08T11:04:31Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-14T16:11:48Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "jq-1.6-6.1.aarch64",
"product": {
"name": "jq-1.6-6.1.aarch64",
"product_id": "jq-1.6-6.1.aarch64"
}
},
{
"category": "product_version",
"name": "libjq1-1.6-6.1.aarch64",
"product": {
"name": "libjq1-1.6-6.1.aarch64",
"product_id": "libjq1-1.6-6.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "jq-1.6-6.1.s390x",
"product": {
"name": "jq-1.6-6.1.s390x",
"product_id": "jq-1.6-6.1.s390x"
}
},
{
"category": "product_version",
"name": "libjq1-1.6-6.1.s390x",
"product": {
"name": "libjq1-1.6-6.1.s390x",
"product_id": "libjq1-1.6-6.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "jq-1.6-6.1.x86_64",
"product": {
"name": "jq-1.6-6.1.x86_64",
"product_id": "jq-1.6-6.1.x86_64"
}
},
{
"category": "product_version",
"name": "libjq1-1.6-6.1.x86_64",
"product": {
"name": "libjq1-1.6-6.1.x86_64",
"product_id": "libjq1-1.6-6.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.0",
"product": {
"name": "SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.0"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-1.6-6.1.aarch64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64"
},
"product_reference": "jq-1.6-6.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-1.6-6.1.s390x as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:jq-1.6-6.1.s390x"
},
"product_reference": "jq-1.6-6.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jq-1.6-6.1.x86_64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64"
},
"product_reference": "jq-1.6-6.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq1-1.6-6.1.aarch64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64"
},
"product_reference": "libjq1-1.6-6.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq1-1.6-6.1.s390x as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x"
},
"product_reference": "libjq1-1.6-6.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libjq1-1.6-6.1.x86_64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64"
},
"product_reference": "libjq1-1.6-6.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-9403",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-9403"
}
],
"notes": [
{
"category": "general",
"text": "A vulnerability was determined in jqlang jq up to 1.6. Impacted is the function run_jq_tests of the file jq_test.c of the component JSON Parser. Executing manipulation can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Other versions might be affected as well.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:jq-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-9403",
"url": "https://www.suse.com/security/cve/CVE-2025-9403"
},
{
"category": "external",
"summary": "SUSE Bug 1248600 for CVE-2025-9403",
"url": "https://bugzilla.suse.com/1248600"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:jq-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:jq-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-08T11:04:31Z",
"details": "low"
}
],
"title": "CVE-2025-9403"
},
{
"cve": "CVE-2026-32316",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-32316"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:jq-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-32316",
"url": "https://www.suse.com/security/cve/CVE-2026-32316"
},
{
"category": "external",
"summary": "SUSE Bug 1262044 for CVE-2026-32316",
"url": "https://bugzilla.suse.com/1262044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:jq-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:jq-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-08T11:04:31Z",
"details": "moderate"
}
],
"title": "CVE-2026-32316"
},
{
"cve": "CVE-2026-33947",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33947"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(), and delpaths_sorted() in jq\u0027s src/jv_aux.c use unbounded recursion whose depth is controlled by the length of a caller-supplied path array, with no depth limit enforced. An attacker can supply a JSON document containing a flat array of ~65,000 integers (~200 KB) that, when used as a path argument by a trusted jq filter, exhausts the C call stack and crashes the process with a segmentation fault (SIGSEGV). This bypass works because the existing MAX_PARSING_DEPTH (10,000) limit only protects the JSON parser, not runtime path operations where arrays can be programmatically constructed to arbitrary lengths. The impact is denial of service (unrecoverable crash) affecting any application or service that processes untrusted JSON input through jq\u0027s setpath, getpath, or delpaths builtins. This issue has been addressed in commit fb59f1491058d58bdc3e8dd28f1773d1ac690a1f.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:jq-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33947",
"url": "https://www.suse.com/security/cve/CVE-2026-33947"
},
{
"category": "external",
"summary": "SUSE Bug 1262069 for CVE-2026-33947",
"url": "https://bugzilla.suse.com/1262069"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:jq-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:jq-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-08T11:04:31Z",
"details": "moderate"
}
],
"title": "CVE-2026-33947"
},
{
"cve": "CVE-2026-33948",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33948"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:jq-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33948",
"url": "https://www.suse.com/security/cve/CVE-2026-33948"
},
{
"category": "external",
"summary": "SUSE Bug 1262043 for CVE-2026-33948",
"url": "https://bugzilla.suse.com/1262043"
},
{
"category": "external",
"summary": "SUSE Bug 1265061 for CVE-2026-33948",
"url": "https://bugzilla.suse.com/1265061"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:jq-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:jq-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-08T11:04:31Z",
"details": "moderate"
}
],
"title": "CVE-2026-33948"
},
{
"cve": "CVE-2026-39956",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39956"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. Prior to version 1.8.2, the _strindices builtin in jq\u0027s src/builtin.c passes its arguments directly to jv_string_indexes() without verifying they are strings, and jv_string_indexes() in src/jv.c relies solely on assert() checks that are stripped in release builds compiled with -DNDEBUG. This allows an attacker to crash jq trivially with input like _strindices(0), and by crafting a numeric value whose IEEE-754 bit pattern maps to a chosen pointer, achieve a controlled pointer dereference and limited memory read/probe primitive. Any deployment that evaluates untrusted jq filters against a release build is vulnerable. This issue has been patched in commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03, which is part of version 1.8.2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:jq-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39956",
"url": "https://www.suse.com/security/cve/CVE-2026-39956"
},
{
"category": "external",
"summary": "SUSE Bug 1262070 for CVE-2026-39956",
"url": "https://bugzilla.suse.com/1262070"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:jq-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:jq-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-08T11:04:31Z",
"details": "moderate"
}
],
"title": "CVE-2026-39956"
},
{
"cve": "CVE-2026-39979",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39979"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:jq-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39979",
"url": "https://www.suse.com/security/cve/CVE-2026-39979"
},
{
"category": "external",
"summary": "SUSE Bug 1262071 for CVE-2026-39979",
"url": "https://bugzilla.suse.com/1262071"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:jq-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:jq-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-08T11:04:31Z",
"details": "moderate"
}
],
"title": "CVE-2026-39979"
},
{
"cve": "CVE-2026-40164",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-40164"
}
],
"notes": [
{
"category": "general",
"text": "jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n), turning any jq expression into an O(n) operation and causing significant CPU exhaustion. This affected common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more practical to exploit than existing heap overflow issues since it required only a small payload. This issue has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:jq-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-40164",
"url": "https://www.suse.com/security/cve/CVE-2026-40164"
},
{
"category": "external",
"summary": "SUSE Bug 1262072 for CVE-2026-40164",
"url": "https://bugzilla.suse.com/1262072"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:jq-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:jq-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:jq-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:jq-1.6-6.1.x86_64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.aarch64",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.s390x",
"SUSE Linux Micro 6.0:libjq1-1.6-6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-08T11:04:31Z",
"details": "moderate"
}
],
"title": "CVE-2026-40164"
}
]
}
ubuntu-cve-2026-39979
Vulnerability from osv_ubuntu
Published
2026-04-13 23:16
Modified
2026-06-30 16:20
Summary
Details
jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.
Severity
8.2 (High)
6.5 (Medium)
N/A (UNKNOWN)
References
{
"affected": [
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "jq",
"binary_version": "1.3-1.1ubuntu1.1+esm4"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:14.04:LTS",
"name": "jq",
"purl": "pkg:deb/ubuntu/jq@1.3-1.1ubuntu1.1+esm4?arch=source\u0026distro=esm-infra-legacy/trusty"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3-1.1ubuntu1.1+esm4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.2-8",
"1.3-1",
"1.3-1.1ubuntu1",
"1.3-1.1ubuntu1.1",
"1.3-1.1ubuntu1.1+esm3"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "jq",
"binary_version": "1.5+dfsg-1ubuntu0.1+esm4"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "jq",
"purl": "pkg:deb/ubuntu/jq@1.5+dfsg-1ubuntu0.1+esm4?arch=source\u0026distro=esm-apps/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5+dfsg-1ubuntu0.1+esm4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.4-2.1",
"1.5+dfsg-1",
"1.5+dfsg-1ubuntu0.1",
"1.5+dfsg-1ubuntu0.1+esm2",
"1.5+dfsg-1ubuntu0.1+esm3"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "jq",
"binary_version": "1.5+dfsg-2ubuntu0.1~esm2"
},
{
"binary_name": "libjq1",
"binary_version": "1.5+dfsg-2ubuntu0.1~esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"name": "jq",
"purl": "pkg:deb/ubuntu/jq@1.5+dfsg-2ubuntu0.1~esm2?arch=source\u0026distro=esm-apps/bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5+dfsg-2ubuntu0.1~esm2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.5+dfsg-2",
"1.5+dfsg-2ubuntu0.1~esm1"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "jq",
"binary_version": "1.6-1ubuntu0.20.04.1+esm2"
},
{
"binary_name": "libjq1",
"binary_version": "1.6-1ubuntu0.20.04.1+esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:20.04:LTS",
"name": "jq",
"purl": "pkg:deb/ubuntu/jq@1.6-1ubuntu0.20.04.1+esm2?arch=source\u0026distro=esm-infra/focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6-1ubuntu0.20.04.1+esm2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.5+dfsg-2build1",
"1.6-1",
"1.6-1ubuntu0.20.04.1",
"1.6-1ubuntu0.20.04.1+esm1"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "jq",
"binary_version": "1.6-2.1ubuntu3.2"
},
{
"binary_name": "libjq1",
"binary_version": "1.6-2.1ubuntu3.2"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "jq",
"purl": "pkg:deb/ubuntu/jq@1.6-2.1ubuntu3.2?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6-2.1ubuntu3.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.6-2.1ubuntu2",
"1.6-2.1ubuntu3",
"1.6-2.1ubuntu3.1"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "jq",
"binary_version": "1.7.1-3ubuntu0.24.04.2"
},
{
"binary_name": "libjq1",
"binary_version": "1.7.1-3ubuntu0.24.04.2"
}
]
},
"package": {
"ecosystem": "Ubuntu:24.04:LTS",
"name": "jq",
"purl": "pkg:deb/ubuntu/jq@1.7.1-3ubuntu0.24.04.2?arch=source\u0026distro=noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.1-3ubuntu0.24.04.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.6-3",
"1.7-1",
"1.7.1-2",
"1.7.1-3",
"1.7.1-3build1",
"1.7.1-3ubuntu0.24.04.1"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "jq",
"binary_version": "1.8.1-3ubuntu1.1"
},
{
"binary_name": "libjq1",
"binary_version": "1.8.1-3ubuntu1.1"
}
]
},
"package": {
"ecosystem": "Ubuntu:25.10",
"name": "jq",
"purl": "pkg:deb/ubuntu/jq@1.8.1-3ubuntu1.1?arch=source\u0026distro=questing"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.8.1-3ubuntu1.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.7.1-3ubuntu1",
"1.7.1-6ubuntu1",
"1.8.1-3ubuntu1"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "jq",
"binary_version": "1.8.1-4ubuntu2"
},
{
"binary_name": "libjq1",
"binary_version": "1.8.1-4ubuntu2"
}
]
},
"package": {
"ecosystem": "Ubuntu:26.04:LTS",
"name": "jq",
"purl": "pkg:deb/ubuntu/jq@1.8.1-4ubuntu2?arch=source\u0026distro=resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.8.1-4ubuntu2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.8.1-3ubuntu1",
"1.8.1-4ubuntu1"
]
}
],
"aliases": [],
"details": "jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.",
"id": "UBUNTU-CVE-2026-39979",
"modified": "2026-06-30T16:20:57Z",
"published": "2026-04-13T23:16:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-39979"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39979"
},
{
"type": "REPORT",
"url": "https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p"
},
{
"type": "REPORT",
"url": "https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-8202-1"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-8202-2"
}
],
"related": [
"USN-8202-1",
"USN-8202-2"
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2026-39979"
]
}
WID-SEC-W-2026-1183
Vulnerability from csaf_certbund - Published: 2026-04-20 22:00 - Updated: 2026-07-01 22:00Summary
Red Hat Hardened Images RPMs (jq und pyOpenSSL): Mehrere Schwachstellen
Severity
Hoch
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.
Angriff: Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Red Hat Hardened Images RPMs ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial-of-Service-Zustand verursachen, vertrauliche Informationen offenlegen oder nicht näher spezifizierte Angriffe durchführen, einschließlich potenzieller Codeausführung.
Betroffene Betriebssysteme: - Linux
- Sonstiges
- UNIX
Affected products
Known affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Splunk SOAR <8.5.0
Splunk / SOAR
|
<8.5.0 | ||
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Red Hat Enterprise Linux
Red Hat / Enterprise Linux
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Ubuntu Linux
Ubuntu
|
cpe:/o:canonical:ubuntu_linux:-
|
— | |
|
Red Hat Enterprise Linux Hardened Images RPMs pyOpenSSL
Red Hat / Enterprise Linux
|
cpe:/o:redhat:enterprise_linux:hardened_images_rpms_pyopenssl
|
Hardened Images RPMs pyOpenSSL | |
|
Oracle Linux
Oracle
|
cpe:/o:oracle:linux:-
|
— | |
|
RESF Rocky Linux
RESF
|
cpe:/o:resf:rocky_linux:-
|
— | |
|
Red Hat OpenShift Container Platform <4.13.68
Red Hat / OpenShift
|
Container Platform <4.13.68 |
Affected products
Known affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Splunk SOAR <8.5.0
Splunk / SOAR
|
<8.5.0 | ||
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Red Hat Enterprise Linux
Red Hat / Enterprise Linux
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Ubuntu Linux
Ubuntu
|
cpe:/o:canonical:ubuntu_linux:-
|
— | |
|
Red Hat Enterprise Linux Hardened Images RPMs pyOpenSSL
Red Hat / Enterprise Linux
|
cpe:/o:redhat:enterprise_linux:hardened_images_rpms_pyopenssl
|
Hardened Images RPMs pyOpenSSL | |
|
Oracle Linux
Oracle
|
cpe:/o:oracle:linux:-
|
— | |
|
RESF Rocky Linux
RESF
|
cpe:/o:resf:rocky_linux:-
|
— | |
|
Red Hat OpenShift Container Platform <4.13.68
Red Hat / OpenShift
|
Container Platform <4.13.68 |
Affected products
Known affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Splunk SOAR <8.5.0
Splunk / SOAR
|
<8.5.0 | ||
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Red Hat Enterprise Linux
Red Hat / Enterprise Linux
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Ubuntu Linux
Ubuntu
|
cpe:/o:canonical:ubuntu_linux:-
|
— | |
|
Red Hat Enterprise Linux Hardened Images RPMs jq
Red Hat / Enterprise Linux
|
cpe:/o:redhat:enterprise_linux:hardened_images_rpms_jq
|
Hardened Images RPMs jq | |
|
Oracle Linux
Oracle
|
cpe:/o:oracle:linux:-
|
— | |
|
RESF Rocky Linux
RESF
|
cpe:/o:resf:rocky_linux:-
|
— | |
|
Red Hat OpenShift Container Platform <4.13.68
Red Hat / OpenShift
|
Container Platform <4.13.68 |
Affected products
Known affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Splunk SOAR <8.5.0
Splunk / SOAR
|
<8.5.0 | ||
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Red Hat Enterprise Linux
Red Hat / Enterprise Linux
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Ubuntu Linux
Ubuntu
|
cpe:/o:canonical:ubuntu_linux:-
|
— | |
|
Red Hat Enterprise Linux Hardened Images RPMs jq
Red Hat / Enterprise Linux
|
cpe:/o:redhat:enterprise_linux:hardened_images_rpms_jq
|
Hardened Images RPMs jq | |
|
Oracle Linux
Oracle
|
cpe:/o:oracle:linux:-
|
— | |
|
RESF Rocky Linux
RESF
|
cpe:/o:resf:rocky_linux:-
|
— | |
|
Red Hat OpenShift Container Platform <4.13.68
Red Hat / OpenShift
|
Container Platform <4.13.68 |
References
47 references
| URL | Category |
|---|---|
| https://wid.cert-bund.de/.well-known/csaf/white/2… | self |
| https://wid.cert-bund.de/portal/wid/securityadvis… | self |
| https://access.redhat.com/errata/RHSA-2026:7224 | external |
| https://access.redhat.com/errata/RHSA-2026:8579 | external |
| https://ubuntu.com/security/notices/USN-8202-1 | external |
| https://lists.suse.com/pipermail/sle-security-upd… | external |
| https://access.redhat.com/errata/RHSA-2026:10754 | external |
| https://ubuntu.com/security/notices/USN-8202-2 | external |
| https://access.redhat.com/errata/RHSA-2026:11916 | external |
| https://access.redhat.com/errata/RHSA-2026:11856 | external |
| https://access.redhat.com/errata/RHSA-2026:11996 | external |
| https://access.redhat.com/errata/RHSA-2026:13545 | external |
| https://access.redhat.com/errata/RHSA-2026:13508 | external |
| https://access.redhat.com/errata/RHSA-2026:13512 | external |
| https://access.redhat.com/errata/RHSA-2026:13553 | external |
| https://access.redhat.com/errata/RHSA-2026:14874 | external |
| https://access.redhat.com/errata/RHSA-2026:14835 | external |
| https://access.redhat.com/errata/RHSA-2026:14873 | external |
| https://access.redhat.com/errata/RHSA-2026:16692 | external |
| https://access.redhat.com/errata/RHSA-2026:16252 | external |
| https://access.redhat.com/errata/RHSA-2026:16693 | external |
| https://access.redhat.com/errata/RHSA-2026:18040 | external |
| https://access.redhat.com/errata/RHSA-2026:18042 | external |
| https://access.redhat.com/errata/RHSA-2026:18043 | external |
| https://access.redhat.com/errata/RHSA-2026:18044 | external |
| https://access.redhat.com/errata/RHSA-2026:18045 | external |
| https://access.redhat.com/errata/RHSA-2026:18047 | external |
| https://access.redhat.com/errata/RHSA-2026:19365 | external |
| https://access.redhat.com/errata/RHSA-2026:19375 | external |
| https://access.redhat.com/errata/RHSA-2026:19151 | external |
| https://ubuntu.com/security/notices/USN-8202-3 | external |
| https://ubuntu.com/security/notices/USN-8335-1 | external |
| https://errata.build.resf.org/RLSA-2026:19365 | external |
| https://errata.build.resf.org/RLSA-2026:19151 | external |
| https://access.redhat.com/errata/RHSA-2026:22465 | external |
| https://lists.suse.com/pipermail/sle-security-upd… | external |
| https://access.redhat.com/errata/RHSA-2026:23245 | external |
| https://access.redhat.com/errata/RHSA-2026:23233 | external |
| https://advisory.splunk.com//advisories/SVD-2026-0612 | external |
| https://access.redhat.com/errata/RHSA-2026:25181 | external |
| https://access.redhat.com/errata/RHSA-2026:25044 | external |
| http://linux.oracle.com/errata/ELSA-2026-19365.html | external |
| http://linux.oracle.com/errata/ELSA-2026-50324.html | external |
| https://access.redhat.com/errata/RHSA-2026:26528 | external |
| https://access.redhat.com/errata/RHSA-2026:26542 | external |
| https://access.redhat.com/errata/RHSA-2026:28887 | external |
| https://lists.debian.org/debian-lts-announce/2026… | external |
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Red Hat Enterprise Linux (RHEL) ist eine popul\u00e4re Linux-Distribution.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Red Hat Hardened Images RPMs ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial-of-Service-Zustand verursachen, vertrauliche Informationen offenlegen oder nicht n\u00e4her spezifizierte Angriffe durchf\u00fchren, einschlie\u00dflich potenzieller Codeausf\u00fchrung.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux\n- Sonstiges\n- UNIX",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2026-1183 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1183.json"
},
{
"category": "self",
"summary": "WID-SEC-2026-1183 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1183"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:7224 vom 2026-04-20",
"url": "https://access.redhat.com/errata/RHSA-2026:7224"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:8579 vom 2026-04-20",
"url": "https://access.redhat.com/errata/RHSA-2026:8579"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8202-1 vom 2026-04-24",
"url": "https://ubuntu.com/security/notices/USN-8202-1"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:1582-1 vom 2026-04-24",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-April/025607.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:10754 vom 2026-04-27",
"url": "https://access.redhat.com/errata/RHSA-2026:10754"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8202-2 vom 2026-04-28",
"url": "https://ubuntu.com/security/notices/USN-8202-2"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:11916 vom 2026-04-30",
"url": "https://access.redhat.com/errata/RHSA-2026:11916"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:11856 vom 2026-04-29",
"url": "https://access.redhat.com/errata/RHSA-2026:11856"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:11996 vom 2026-04-30",
"url": "https://access.redhat.com/errata/RHSA-2026:11996"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:13545 vom 2026-05-04",
"url": "https://access.redhat.com/errata/RHSA-2026:13545"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:13508 vom 2026-05-04",
"url": "https://access.redhat.com/errata/RHSA-2026:13508"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:13512 vom 2026-05-04",
"url": "https://access.redhat.com/errata/RHSA-2026:13512"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:13553 vom 2026-05-04",
"url": "https://access.redhat.com/errata/RHSA-2026:13553"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:14874 vom 2026-05-07",
"url": "https://access.redhat.com/errata/RHSA-2026:14874"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:14835 vom 2026-05-07",
"url": "https://access.redhat.com/errata/RHSA-2026:14835"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:14873 vom 2026-05-07",
"url": "https://access.redhat.com/errata/RHSA-2026:14873"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:16692 vom 2026-05-13",
"url": "https://access.redhat.com/errata/RHSA-2026:16692"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:16252 vom 2026-05-12",
"url": "https://access.redhat.com/errata/RHSA-2026:16252"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:16693 vom 2026-05-13",
"url": "https://access.redhat.com/errata/RHSA-2026:16693"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:18040 vom 2026-05-18",
"url": "https://access.redhat.com/errata/RHSA-2026:18040"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:18042 vom 2026-05-18",
"url": "https://access.redhat.com/errata/RHSA-2026:18042"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:18043 vom 2026-05-18",
"url": "https://access.redhat.com/errata/RHSA-2026:18043"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:18044 vom 2026-05-18",
"url": "https://access.redhat.com/errata/RHSA-2026:18044"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:18045 vom 2026-05-18",
"url": "https://access.redhat.com/errata/RHSA-2026:18045"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:18047 vom 2026-05-18",
"url": "https://access.redhat.com/errata/RHSA-2026:18047"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:19365 vom 2026-05-19",
"url": "https://access.redhat.com/errata/RHSA-2026:19365"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:19375 vom 2026-05-20",
"url": "https://access.redhat.com/errata/RHSA-2026:19375"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:19151 vom 2026-05-19",
"url": "https://access.redhat.com/errata/RHSA-2026:19151"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8202-3 vom 2026-05-21",
"url": "https://ubuntu.com/security/notices/USN-8202-3"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8335-1 vom 2026-05-28",
"url": "https://ubuntu.com/security/notices/USN-8335-1"
},
{
"category": "external",
"summary": "Rocky Linux Security Advisory RLSA-2026:19365 vom 2026-05-28",
"url": "https://errata.build.resf.org/RLSA-2026:19365"
},
{
"category": "external",
"summary": "Rocky Linux Security Advisory RLSA-2026:19151 vom 2026-05-29",
"url": "https://errata.build.resf.org/RLSA-2026:19151"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:22465 vom 2026-06-02",
"url": "https://access.redhat.com/errata/RHSA-2026:22465"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:21990-1 vom 2026-06-05",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-June/026591.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:23245 vom 2026-06-10",
"url": "https://access.redhat.com/errata/RHSA-2026:23245"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:23233 vom 2026-06-11",
"url": "https://access.redhat.com/errata/RHSA-2026:23233"
},
{
"category": "external",
"summary": "Splunk Security Advisory SVD-2026-0612 vom 2026-06-10",
"url": "https://advisory.splunk.com//advisories/SVD-2026-0612"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:25181 vom 2026-06-17",
"url": "https://access.redhat.com/errata/RHSA-2026:25181"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:25044 vom 2026-06-18",
"url": "https://access.redhat.com/errata/RHSA-2026:25044"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2026-19365 vom 2026-06-25",
"url": "http://linux.oracle.com/errata/ELSA-2026-19365.html"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2026-50324 vom 2026-06-25",
"url": "http://linux.oracle.com/errata/ELSA-2026-50324.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:26528 vom 2026-06-25",
"url": "https://access.redhat.com/errata/RHSA-2026:26528"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:26542 vom 2026-06-25",
"url": "https://access.redhat.com/errata/RHSA-2026:26542"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:28887 vom 2026-07-01",
"url": "https://access.redhat.com/errata/RHSA-2026:28887"
},
{
"category": "external",
"summary": "Debian Security Advisory DLA-4662 vom 2026-07-01",
"url": "https://lists.debian.org/debian-lts-announce/2026/07/msg00003.html"
}
],
"source_lang": "en-US",
"title": "Red Hat Hardened Images RPMs (jq und pyOpenSSL): Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2026-07-01T22:00:00.000+00:00",
"generator": {
"date": "2026-07-02T09:22:58.522+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.6.0"
}
},
"id": "WID-SEC-W-2026-1183",
"initial_release_date": "2026-04-20T22:00:00.000+00:00",
"revision_history": [
{
"date": "2026-04-20T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2026-04-23T22:00:00.000+00:00",
"number": "2",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2026-04-26T22:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-04-27T22:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2026-04-29T22:00:00.000+00:00",
"number": "5",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-05-04T22:00:00.000+00:00",
"number": "6",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-05-07T22:00:00.000+00:00",
"number": "7",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-05-12T22:00:00.000+00:00",
"number": "8",
"summary": "Neue Updates von Red Hat und Open Source aufgenommen"
},
{
"date": "2026-05-17T22:00:00.000+00:00",
"number": "9",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-05-18T22:00:00.000+00:00",
"number": "10",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-05-19T22:00:00.000+00:00",
"number": "11",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-05-20T22:00:00.000+00:00",
"number": "12",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2026-05-28T22:00:00.000+00:00",
"number": "13",
"summary": "Neue Updates von Ubuntu und Rocky Enterprise Software Foundation aufgenommen"
},
{
"date": "2026-05-31T22:00:00.000+00:00",
"number": "14",
"summary": "Neue Updates von Rocky Enterprise Software Foundation aufgenommen"
},
{
"date": "2026-06-02T22:00:00.000+00:00",
"number": "15",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-06-07T22:00:00.000+00:00",
"number": "16",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2026-06-09T22:00:00.000+00:00",
"number": "17",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-06-10T22:00:00.000+00:00",
"number": "18",
"summary": "Neue Updates von Red Hat und Splunk-SVD aufgenommen"
},
{
"date": "2026-06-17T22:00:00.000+00:00",
"number": "19",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-06-18T22:00:00.000+00:00",
"number": "20",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-06-24T22:00:00.000+00:00",
"number": "21",
"summary": "Neue Updates von Oracle Linux aufgenommen"
},
{
"date": "2026-07-01T22:00:00.000+00:00",
"number": "22",
"summary": "Neue Updates von Red Hat und Debian aufgenommen"
}
],
"status": "final",
"version": "22"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Debian Linux",
"product": {
"name": "Debian Linux",
"product_id": "2951",
"product_identification_helper": {
"cpe": "cpe:/o:debian:debian_linux:-"
}
}
}
],
"category": "vendor",
"name": "Debian"
},
{
"branches": [
{
"category": "product_name",
"name": "Oracle Linux",
"product": {
"name": "Oracle Linux",
"product_id": "T004914",
"product_identification_helper": {
"cpe": "cpe:/o:oracle:linux:-"
}
}
}
],
"category": "vendor",
"name": "Oracle"
},
{
"branches": [
{
"category": "product_name",
"name": "RESF Rocky Linux",
"product": {
"name": "RESF Rocky Linux",
"product_id": "T032255",
"product_identification_helper": {
"cpe": "cpe:/o:resf:rocky_linux:-"
}
}
}
],
"category": "vendor",
"name": "RESF"
},
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux",
"product": {
"name": "Red Hat Enterprise Linux",
"product_id": "67646",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:-"
}
}
},
{
"category": "product_version",
"name": "Hardened Images RPMs pyOpenSSL",
"product": {
"name": "Red Hat Enterprise Linux Hardened Images RPMs pyOpenSSL",
"product_id": "T053017",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:hardened_images_rpms_pyopenssl"
}
}
},
{
"category": "product_version",
"name": "Hardened Images RPMs jq",
"product": {
"name": "Red Hat Enterprise Linux Hardened Images RPMs jq",
"product_id": "T053018",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:hardened_images_rpms_jq"
}
}
}
],
"category": "product_name",
"name": "Enterprise Linux"
},
{
"branches": [
{
"category": "product_version_range",
"name": "Container Platform \u003c4.13.68",
"product": {
"name": "Red Hat OpenShift Container Platform \u003c4.13.68",
"product_id": "T055798"
}
},
{
"category": "product_version",
"name": "Container Platform 4.13.68",
"product": {
"name": "Red Hat OpenShift Container Platform 4.13.68",
"product_id": "T055798-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:container_platform__4.13.68"
}
}
}
],
"category": "product_name",
"name": "OpenShift"
}
],
"category": "vendor",
"name": "Red Hat"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux",
"product": {
"name": "SUSE Linux",
"product_id": "T002207",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_linux:-"
}
}
}
],
"category": "vendor",
"name": "SUSE"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c8.5.0",
"product": {
"name": "Splunk SOAR \u003c8.5.0",
"product_id": "T055212"
}
},
{
"category": "product_version",
"name": "8.5.0",
"product": {
"name": "Splunk SOAR 8.5.0",
"product_id": "T055212-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:splunk:soar:8.5.0"
}
}
}
],
"category": "product_name",
"name": "SOAR"
}
],
"category": "vendor",
"name": "Splunk"
},
{
"branches": [
{
"category": "product_name",
"name": "Ubuntu Linux",
"product": {
"name": "Ubuntu Linux",
"product_id": "T000126",
"product_identification_helper": {
"cpe": "cpe:/o:canonical:ubuntu_linux:-"
}
}
}
],
"category": "vendor",
"name": "Ubuntu"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27448",
"product_status": {
"known_affected": [
"T055212",
"2951",
"T002207",
"67646",
"T000126",
"T053017",
"T004914",
"T032255",
"T055798"
]
},
"release_date": "2026-04-20T22:00:00.000+00:00",
"title": "CVE-2026-27448"
},
{
"cve": "CVE-2026-27459",
"product_status": {
"known_affected": [
"T055212",
"2951",
"T002207",
"67646",
"T000126",
"T053017",
"T004914",
"T032255",
"T055798"
]
},
"release_date": "2026-04-20T22:00:00.000+00:00",
"title": "CVE-2026-27459"
},
{
"cve": "CVE-2026-39979",
"product_status": {
"known_affected": [
"T055212",
"2951",
"T002207",
"67646",
"T000126",
"T053018",
"T004914",
"T032255",
"T055798"
]
},
"release_date": "2026-04-20T22:00:00.000+00:00",
"title": "CVE-2026-39979"
},
{
"cve": "CVE-2026-40164",
"product_status": {
"known_affected": [
"T055212",
"2951",
"T002207",
"67646",
"T000126",
"T053018",
"T004914",
"T032255",
"T055798"
]
},
"release_date": "2026-04-20T22:00:00.000+00:00",
"title": "CVE-2026-40164"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…