Red Hat issued a security advisory (RHSA-2026:8579) updating RPMs for Red Hat Hardened Images, including jq version 1.8.1-3.hum1 for aarch64 and x86_64. The advisory addresses several CVEs, notably CVE-2026-40164, which describes a denial of service vulnerability in jq caused by hash collisions triggered by specially crafted JSON objects. The vulnerability stems from jq's use of a hardcoded, publicly known seed in its hashing algorithm, allowing attackers to degrade hash table performance and exhaust CPU resources. Red Hat currently does not provide a mitigation or fix that meets their criteria for ease of use, applicability, or stability. The advisory includes references to related CVEs and Red Hat's security resources but does not list fixed versions or patches. No known exploits in the wild have been reported.

The primary impact is a denial of service condition caused by CPU exhaustion when processing malicious JSON data with jq. This can disrupt systems relying on jq for JSON processing, potentially affecting availability. No confidentiality or integrity impacts are reported. The vulnerability affects Red Hat Hardened Images RPMs containing jq, impacting systems using these packages on aarch64 and x86_64 architectures. No known active exploitation has been reported.

Currently, Red Hat states that no mitigation is available or that existing options do not meet their criteria for deployment and stability. Users should monitor Red Hat advisories for updates or fixes. Applying the updated RPMs when available and following Red Hat's official guidance is recommended. Customers with Red Hat Technical Account Managers (TAM) may consult them for tailored advice. No urgent action is mandated beyond applying updates once provided.