This Red Hat security advisory (RHSA-2026:29986) updates jq RPM packages in Red Hat Hardened Images to address nine CVEs including CVE-2026-43895, which involves improper input validation allowing embedded NUL bytes in import paths to truncate paths and bypass intended file access restrictions. The advisory includes jq-1.8.2-0.1.hum1 packages for aarch64 and x86_64 architectures. The vulnerabilities relate to multiple CWEs such as CWE-20 (Improper Input Validation), CWE-674, CWE-158, CWE-190, CWE-770, and CWE-787. Red Hat rates the severity as medium and advises not to process untrusted scripts with jq. No known exploits in the wild have been reported. The advisory does not explicitly state fixed versions beyond the updated package release. Patch status is implied by the availability of updated RPMs.

The vulnerabilities allow attackers who can supply crafted jq scripts to bypass path validation and potentially access unintended files, leading to confidentiality breaches. Other impacts include possible denial of service via resource consumption or crashes, and potential integrity issues through unauthorized code execution or memory modification. The overall impact is rated moderate by Red Hat, with low confidentiality and integrity impacts and no availability impact reported. No active exploitation is known.

Red Hat has released updated jq RPM packages (jq-1.8.2-0.1.hum1) for affected architectures. Users should apply these updates to remediate the vulnerabilities. Until updates are applied, avoid processing untrusted jq scripts to prevent exploitation. Red Hat manages remediation through these official package updates. Patch status is confirmed by the advisory indicating updated RPMs are available.