Threats Tagged 'cve-2026-39956'
View all threats tagged with 'cve-2026-39956'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-39956'
Click on any threat for detailed analysis and mitigation recommendations
0 This update includes the following RPMs: jq: * jq-1.8.1-3.hum1 (aarch64, x86_64) * jq-devel-1.8.1-3.hum1 (aarch64, x86_64) * jq-1.8.1-3.hum1.src (src) Join the discussion | GCVE Database | 04/16/2026, 20:52:41 UTC Added: 06/10/2026, 16:23:44 UTC |
0 jq is a command-line JSON processor. Prior to version 1.8.2, the _strindices builtin in jq's src/builtin.c passes its arguments directly to jv_string_indexes() without verifying they are strings, and jv_string_indexes() in src/jv.c relies solely on assert() checks that are stripped in release builds compiled with -DNDEBUG. This allows an attacker to crash jq trivially with input like _strindices(0), and by crafting a numeric value whose IEEE-754 bit pattern maps to a chosen pointer, achieve a controlled pointer dereference and limited memory read/probe primitive. Any deployment that evaluates untrusted jq filters against a release build is vulnerable. This issue has been patched in commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03, which is part of version 1.8.2. Join the discussion | CVE Database V5 | 04/13/2026, 22:10:18 UTC Added: 04/13/2026, 22:31:51 UTC |
Showing 1 to 2 of 2 results