jq is a lightweight command-line JSON processor included in Red Hat Enterprise Linux 8.6 and related variants. Two security issues have been fixed: an out-of-bounds read in the jv_parse_sized() function triggered by error formatting of non-NUL-terminated buffers (CVE-2026-39979), and a denial of service vulnerability caused by crafted JSON objects that produce hash collisions (CVE-2026-40164). These vulnerabilities could lead to application crashes or denial of service conditions. Red Hat has issued an important security advisory (RHSA-2026:18047) with updated jq packages to resolve these issues. The advisory does not provide CVSS scores but rates the impact as important (high severity). No exploits are currently known in the wild.

The out-of-bounds read vulnerability may cause jq to read memory beyond allocated buffers, potentially leading to crashes or undefined behavior. The denial of service vulnerability can be triggered by specially crafted JSON input causing hash collisions, resulting in resource exhaustion or application unavailability. Both vulnerabilities affect jq usage on Red Hat Enterprise Linux 8.6 variants. There are no reports of active exploitation in the wild at this time.

Red Hat has released updated jq packages for Red Hat Enterprise Linux 8.6 and related variants that address these vulnerabilities. Users should apply these official updates promptly to remediate the issues. Detailed update instructions are available in the Red Hat advisory (https://access.redhat.com/articles/11258). No additional mitigation steps are indicated or required beyond applying the provided patches.