Critical Security Update for jq Package: Out-of-Bounds Read and Denial of Service Vulnerabilities
Summary
ALSA-2026:19151: Important: jq security update. Affects jq versions < 1.7.1-11.el10_2.2. Fixed in 1.7.1-11.el10_2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jq is a lightweight and flexible command-line JSON processor that allows users to slice, filter, map, and transform structured data with ease. It is widely used for manipulating JSON data in various applications. However, recent vulnerabilities have been identified that could compromise the security and stability of systems utilizing jq.
Vulnerability Detail
The vulnerabilities in jq stem from two main issues: an out-of-bounds read in the function jv_parse_sized() when formatting errors for non-NUL-terminated buffers (CVE-2026-39979) and a Denial of Service (DoS) vulnerability caused by crafted JSON objects that lead to hash collisions (CVE-2026-40164). These vulnerabilities can allow attackers to exploit the jq processor, potentially leading to unauthorized access or service interruptions.
How To Fix
Minimum fixed version
1.7.1-11.el10_2.2
This is the first release that contains the fix.
sudo dnf update jqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted JSON data with jq until the update is applied. Additionally, consider implementing input validation to mitigate the risk of crafted JSON objects causing hash collisions.
Conclusion
In summary, jq has critical vulnerabilities that need to be addressed promptly to ensure the security and stability of applications that rely on it. Updating to the latest patched version is essential, and users should be cautious when handling untrusted JSON data.
See every vulnerability recorded for jq →
FAQ
jq is a command-line tool for processing JSON data, allowing users to manipulate and transform JSON structures easily.
The vulnerabilities include an out-of-bounds read and a Denial of Service due to crafted JSON objects causing hash collisions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
If an immediate update is not possible, avoid processing untrusted JSON data and implement input validation as a temporary measure.
For more details, refer to the CVE pages associated with the vulnerabilities: CVE-2026-39979 and CVE-2026-40164.
Related vulnerabilities
Recent vulnerabilities recorded for jq.
