jq is a lightweight command-line tool for processing JSON data. Two vulnerabilities were found: an out-of-bounds read in the jv_parse_sized() function when handling non-NUL-terminated buffers (CVE-2026-39979), and a denial of service via crafted JSON objects causing hash collisions (CVE-2026-40164). These issues could lead to memory safety problems and service disruption. Red Hat released updated jq packages for Red Hat Enterprise Linux 10.0 Extended Update Support to fix these vulnerabilities. The advisory RHSA-2026:18040 provides details and instructions for applying the update. No CVSS scores are provided, but the severity is rated as important/high by Red Hat.

The out-of-bounds read vulnerability could cause memory safety issues potentially leading to crashes or undefined behavior when jq processes malformed JSON input. The denial of service vulnerability allows an attacker to craft JSON objects that cause hash collisions, potentially leading to resource exhaustion and service disruption. These vulnerabilities affect jq versions included in Red Hat Enterprise Linux 10.0 Extended Update Support and related CodeReady Linux Builder variants. No known exploits in the wild have been reported at this time.

Red Hat has released updated jq packages that address these vulnerabilities. Users of affected Red Hat Enterprise Linux 10.0 Extended Update Support versions and related CodeReady Linux Builder products should apply the updates as described in Red Hat advisory RHSA-2026:18040 and the article https://access.redhat.com/articles/11258. Applying these official patches is the recommended remediation. Patch status is confirmed as available from the vendor advisory.