SB20260819122 - Anolis OS update for jq
Published: August 19, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Uncontrolled Recursion (CVE-ID: CVE-2026-40612)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in jv_contains when processing deeply nested arrays or objects through contains() or inside(). A local user can supply a specially crafted nested input structure to cause a denial of service.
In libjq embedded in larger applications, exploitation may corrupt adjacent memory on systems without stack guard pages or with heap-allocated thread stacks.
2) Improper Neutralization of Null Byte or NUL Character (CVE-ID: CVE-2026-41256)
CWE-ID: CWE-158 - Improper Neutralization of Null Byte or NUL Character
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass intended jq program integrity checks.
The vulnerability exists due to improper neutralization of null byte or NUL character in the top-level jq program compilation path when loading a jq program from a file with -f. A remote attacker can supply a crafted filter file containing an embedded NUL byte to bypass intended jq program integrity checks.
User interaction is required to run jq with the crafted filter file.
3) Uncontrolled Recursion (CVE-ID: CVE-2026-44777)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in jq module loader when processing mutually including modules through the -L / include mechanism. A remote attacker can provide a valid pair of mutually including modules to cause a denial of service.
Exploitation requires jq to run against attacker-influenced programs or attacker-influenced module search paths.
Remediation
Install update from vendor's website.