Threats Tagged 'cve-2026-41256'

Multiple security vulnerabilities have been identified and fixed in the jq tool by the SUSE Product Security Team. These include heap buffer overflows, integer overflows, unbounded recursion leading to resource exhaustion, missing runtime type checks causing crashes, out-of-bounds reads, denial of service via resource exhaustion, memory corruption, and validation bypass. The vulnerabilities affect jq version 1.7.1-160000.3.1.aarch64. No known exploits in the wild have been reported.

This update includes the following RPMs: jq: * jq-1.8.2-0.1.hum1 (aarch64, x86_64) * jq-devel-1.8.2-0.1.hum1 (aarch64, x86_64) * jq-1.8.2-0.1.hum1.src (src)

jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.