Critical Security Update for jq: Out-of-Bounds Read and Denial of Service Vulnerabilities
Summary
ALSA-2026:16692: Important: jq security update. Affects jq versions < 1.7.1-11.el10_1.0.2. Fixed in 1.7.1-11.el10_1.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jq is a lightweight and flexible command-line JSON processor, designed to handle JSON data with ease. It allows users to slice, filter, map, and transform structured data similarly to how sed, awk, and grep manipulate text. This versatility makes jq a popular tool among developers and system administrators. However, recent vulnerabilities have been identified that could compromise its security and stability.
Vulnerability Detail
The vulnerabilities in jq stem from two main issues: an out-of-bounds read in the function jv_parse_sized() when formatting errors for non-NUL-terminated buffers (CVE-2026-39979) and a Denial of Service (DoS) vulnerability caused by crafted JSON objects that lead to hash collisions (CVE-2026-40164). These vulnerabilities can potentially allow attackers to read beyond allocated memory, leading to unpredictable behavior, or to crash the application through specially crafted input.
How To Fix
Minimum fixed version
1.7.1-11.el10_1.0.2
This is the first release that contains the fix.
sudo dnf update jqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for these vulnerabilities. The best course of action is to apply the security update as soon as it is available.
Conclusion
The vulnerabilities identified in jq pose significant risks, including potential memory access issues and Denial of Service attacks. It is crucial for users to update to the latest patched version to ensure the security and reliability of their applications. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain a secure environment.
See every vulnerability recorded for jq →
FAQ
jq is a command-line tool for processing JSON data, allowing users to manipulate and transform structured data easily.
The vulnerabilities include an out-of-bounds read and a Denial of Service (DoS) attack vector through crafted JSON objects.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
While there are no specific workarounds, it is recommended to limit the use of jq with untrusted JSON inputs until the update can be applied.
For detailed information, refer to the CVE pages: CVE-2026-39979 and CVE-2026-40164.
Related vulnerabilities
Recent vulnerabilities recorded for jq.
