Threats Tagged 'cve-2026-43895'

This security update for jq addresses two vulnerabilities: CVE-2026-43895, where embedded NUL bytes in import paths can cause policy bypass and disclosure of sensitive information, and CVE-2026-47770, a stack overflow in deep structural equality checks. The update fixes these issues in the affected version 1.7.1-160000.5.1.aarch64. No CVSS score is provided, but the impact is assessed as medium severity.

This update includes the following RPMs: jq: * jq-1.8.2-0.1.hum1 (aarch64, x86_64) * jq-devel-1.8.2-0.1.hum1 (aarch64, x86_64) * jq-1.8.2-0.1.hum1.src (src)

jq versions 1.8.1 and earlier contain an improper input validation vulnerability related to embedded NUL bytes in import paths. The jq language parser accepts these NUL bytes, but the underlying file path resolution uses C string operations that terminate at the NUL byte, causing a mismatch between the validated import string and the actual file accessed. This discrepancy can lead to unintended file access. The vulnerability has a medium severity with a CVSS score of 4.4. No official patch or remediation has been confirmed at this time.