Red Hat Product Security issued an advisory (RHSA-2026:16252) for jq, fixing two vulnerabilities: CVE-2026-39979, an out-of-bounds read in jv_parse_sized() triggered by error formatting of non-NUL-terminated buffers, and CVE-2026-40164, a denial of service vulnerability caused by crafted JSON objects that induce hash collisions. The vulnerabilities affect jq packages distributed with Red Hat Enterprise Linux 8 and related CodeReady Linux Builder variants across multiple architectures (x86_64, s390x, ppc64le, aarch64). The update to jq version 1.6-12.el8_10 addresses these issues. The advisory provides package details and references for applying the update. No known exploits in the wild have been reported at this time.

The out-of-bounds read vulnerability (CVE-2026-39979) could lead to application crashes or potential information disclosure when jq processes malformed JSON buffers. The denial of service vulnerability (CVE-2026-40164) could allow an attacker to cause jq to consume excessive resources or crash by submitting specially crafted JSON objects that cause hash collisions. These issues impact jq usage on affected Red Hat Enterprise Linux 8 systems and related builder environments. No evidence of active exploitation is reported.

Red Hat has released an updated jq package (version 1.6-12.el8_10) that fixes both vulnerabilities. Users of affected Red Hat Enterprise Linux 8 and related CodeReady Linux Builder products should apply the update promptly following Red Hat's official guidance at https://access.redhat.com/articles/11258. No alternative mitigations are indicated in the advisory. The vendor rates the update as Important and recommends patching to remediate these issues.