The jq utility in Red Hat Enterprise Linux 10 and related products contains two vulnerabilities: an out-of-bounds read in the jv_parse_sized() function when processing non-NUL-terminated buffers (CVE-2026-39979), and a denial of service vulnerability caused by crafted JSON objects that trigger hash collisions (CVE-2026-40164). These issues could lead to application crashes or denial of service conditions. Red Hat has issued an update (RHSA-2026:19151) that fixes these vulnerabilities across various supported architectures and product variants. The advisory references updated jq packages version 1.7.1-11.el10_2.2 and provides instructions for applying the update. The vulnerabilities are rated as Important by Red Hat, but no CVSS base score is provided.

Successful exploitation of CVE-2026-39979 could result in out-of-bounds memory reads, potentially causing application crashes or undefined behavior when jq processes malformed JSON input. CVE-2026-40164 could allow an attacker to cause denial of service by crafting JSON objects that produce hash collisions, leading to excessive resource consumption or application unavailability. Both vulnerabilities affect jq as included in Red Hat Enterprise Linux 10 and related products, impacting systems that process untrusted JSON data with jq.

Red Hat has released official security updates that address these vulnerabilities in jq for Red Hat Enterprise Linux 10 and related products. Users should apply the updated jq packages as provided in advisory RHSA-2026:19151. The vendor advisory provides detailed instructions and package links for remediation. No additional mitigation steps are indicated beyond applying the official update.