The jq utility, used for processing JSON data on the command line, contains two security flaws. The first (CVE-2026-39979) is an out-of-bounds read vulnerability in the jv_parse_sized() function triggered by error formatting of non-NUL-terminated buffers, which could lead to memory safety issues. The second (CVE-2026-40164) is a denial of service vulnerability caused by specially crafted JSON objects that induce hash collisions, potentially causing jq to consume excessive resources or crash. Red Hat has released updated jq packages for Red Hat Enterprise Linux 9.4 Extended Update Support and related products to address these vulnerabilities.

Successful exploitation of CVE-2026-39979 could result in out-of-bounds memory reads, which may lead to application crashes or potentially expose sensitive memory contents. CVE-2026-40164 could allow an attacker to cause denial of service by supplying crafted JSON input that triggers hash collisions, leading to resource exhaustion or jq process termination. The advisory rates the overall security impact as Important. There are no reports of active exploitation in the wild.

Red Hat has released updated jq packages for affected Red Hat Enterprise Linux 9.4 Extended Update Support and related products. Users should apply these official updates promptly to remediate the vulnerabilities. For detailed instructions on applying the update, refer to the Red Hat article at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.