Threats Tagged 'cve-2026-44777'

Multiple vulnerabilities in jq can cause process crashes due to unbounded or uncontrolled recursion, heap out-of-bounds writes, and buffer overruns on 32-bit systems. These issues include stack exhaustion from recursive object merges and module loading, a heap corruption bug triggered by --rawfile with oversized strings, and an integer overflow leading to buffer overrun.

This update includes the following RPMs: jq: * jq-1.8.2-0.1.hum1 (aarch64, x86_64) * jq-devel-1.8.2-0.1.hum1 (aarch64, x86_64) * jq-1.8.2-0.1.hum1.src (src)

CVE-2026-44777 is a medium severity vulnerability in the jq command-line JSON processor (version 1.8.2rc1 and earlier). The issue involves uncontrolled recursion in the ordinary module loader when two valid modules include each other, causing recursion without cycle detection. This can lead to potential denial of service or resource exhaustion. No official patch or remediation guidance is currently available from the vendor. Users should monitor vendor advisories for updates and avoid using mutually recursive modules until a fix is provided.