Threats Tagged 'cve-2026-43896'

Multiple vulnerabilities in jq can cause process crashes due to unbounded or uncontrolled recursion, heap out-of-bounds writes, and buffer overruns on 32-bit systems. These issues include stack exhaustion from recursive object merges and module loading, a heap corruption bug triggered by --rawfile with oversized strings, and an integer overflow leading to buffer overrun.

This update includes the following RPMs: jq: * jq-1.8.2-0.1.hum1 (aarch64, x86_64) * jq-devel-1.8.2-0.1.hum1 (aarch64, x86_64) * jq-1.8.2-0.1.hum1.src (src)

CVE-2026-43896 is a medium severity vulnerability in jq versions 1.8.1 and earlier caused by uncontrolled recursion in the jv_object_merge_recursive() function. This occurs when using the * operator on two JSON objects, potentially causing a segmentation fault and crashing the jq process. The vulnerability impacts availability but does not affect confidentiality or integrity. No official patch or remediation is currently available. Users should monitor vendor advisories for updates and exercise caution when processing untrusted JSON with affected jq versions.