Threats Tagged 'cve-2026-43894'

Multiple security vulnerabilities have been identified and fixed in the jq tool by the SUSE Product Security Team. These include heap buffer overflows, integer overflows, unbounded recursion leading to resource exhaustion, missing runtime type checks causing crashes, out-of-bounds reads, denial of service via resource exhaustion, memory corruption, and validation bypass. The vulnerabilities affect jq version 1.7.1-160000.3.1.aarch64. No known exploits in the wild have been reported.

This update includes the following RPMs: jq: * jq-1.8.2-0.1.hum1 (aarch64, x86_64) * jq-devel-1.8.2-0.1.hum1 (aarch64, x86_64) * jq-1.8.2-0.1.hum1.src (src)

CVE-2026-43894 is an integer overflow vulnerability in jq versions 1.8.1 and earlier. The vulnerability occurs when processing a very large number literal, causing a signed integer overflow that bypasses heap allocation checks and leads to a large buffer write on the stack with attacker-controlled data. This can result in a denial of service due to stack corruption. No patch or official remediation is currently confirmed.