Threats Tagged 'cve-2026-40612'

Multiple security vulnerabilities have been identified and fixed in the jq tool by the SUSE Product Security Team. These include heap buffer overflows, integer overflows, unbounded recursion leading to resource exhaustion, missing runtime type checks causing crashes, out-of-bounds reads, denial of service via resource exhaustion, memory corruption, and validation bypass. The vulnerabilities affect jq version 1.7.1-160000.3.1.aarch64. No known exploits in the wild have been reported.

This update includes the following RPMs: jq: * jq-1.8.2-0.1.hum1 (aarch64, x86_64) * jq-devel-1.8.2-0.1.hum1 (aarch64, x86_64) * jq-1.8.2-0.1.hum1.src (src)

CVE-2026-40612 is a medium severity vulnerability in jq (version 1.8.1 and earlier) where the function jv_contains performs uncontrolled recursion into nested JSON arrays or objects without a depth limit. This can lead to exhaustion of the C stack when processing sufficiently deeply nested input structures, causing a denial of service. The vulnerability arises because jq's JSON parser limits nesting depth to 10,000, but programmatically constructed inputs using reduce can exceed this, triggering the recursion issue.