SB2026081996 - Debian update for jq
Published: August 19, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 12 vulnerabilities.
1) Stack-based buffer overflow (CVE-ID: CVE-2024-53427)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the decNumberCopy() function in decNumber.c. A remote attacker can pass specially crafted input to the application, trigger a stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note, the vulnerability exists due to incomplete fix for #VU106250 (CVE-2023-50268).
2) Integer overflow (CVE-ID: CVE-2026-32316)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow in the "jvp_string_append" and "jvp_string_copy_replace_bad" functions. A remote attacker can pass specially crafted data to the application, trigger integer overflow and cause a denial of service condition on the target system.
3) Uncontrolled Recursion (CVE-ID: CVE-2026-40612)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in jv_contains when processing deeply nested arrays or objects through contains() or inside(). A local user can supply a specially crafted nested input structure to cause a denial of service.
In libjq embedded in larger applications, exploitation may corrupt adjacent memory on systems without stack guard pages or with heap-allocated thread stacks.
4) Improper Neutralization of Null Byte or NUL Character (CVE-ID: CVE-2026-41256)
CWE-ID: CWE-158 - Improper Neutralization of Null Byte or NUL Character
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass intended jq program integrity checks.
The vulnerability exists due to improper neutralization of null byte or NUL character in the top-level jq program compilation path when loading a jq program from a file with -f. A remote attacker can supply a crafted filter file containing an embedded NUL byte to bypass intended jq program integrity checks.
User interaction is required to run jq with the crafted filter file.
5) Integer overflow (CVE-ID: CVE-2026-41257)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to integer overflow in stack_reallocate in the jq VM stack when processing deeply nested generator forks. A local user can supply crafted jq input to trigger signed integer overflow and abort the process to cause a denial of service.
In the observed case, the wrapped allocation size causes memory allocation failure and process abort. A small positive truncation may also lead to a wild memmove write before the buffer.
6) Out-of-bounds write (CVE-ID: CVE-2026-43894)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds write in decNumber D2U() macro in decNumberFromString when processing an extremely large decimal string via tonumber. A remote attacker can supply a specially crafted number string to cause a denial of service.
The issue is triggered by signed integer overflow and is reachable through tonumber on a string built via the multiplication operator rather than through raw JSON number parsing.
7) Improper Neutralization of Null Byte or NUL Character (CVE-ID: CVE-2026-43895)
CWE-ID: CWE-158 - Improper Neutralization of Null Byte or NUL Character
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to compromise the target system.
The vulnerability exists due to improper neutralization of null byte or NUL character in src/linker.c. A local user can cause the target application to load a different module or JSON data file than the one approved by the policy layer.
8) Uncontrolled Recursion (CVE-ID: CVE-2026-43896)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to uncontrolled recursion in the "jv_object_merge_recursive()" function in src/jv.c. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
9) Uncontrolled Recursion (CVE-ID: CVE-2026-44777)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in jq module loader when processing mutually including modules through the -L / include mechanism. A remote attacker can provide a valid pair of mutually including modules to cause a denial of service.
Exploitation requires jq to run against attacker-influenced programs or attacker-influenced module search paths.
10) Stack-based buffer overflow (CVE-ID: CVE-2026-47770)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to stack-based buffer overflow in deep structural equality when parsing input. A local user can supply specially crafted input to cause a denial of service.
11) Out-of-bounds write (CVE-ID: CVE-2026-49839)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds write in the --rawfile handling in jv_load_file() when processing an attacker-controlled file. A remote attacker can supply a crafted oversized file to cause a denial of service.
User interaction is required to process the crafted file, and the heap-buffer-overflow occurs in assertion-disabled builds after a handled \"String too long\" error is reused as a string state.
12) Integer overflow (CVE-ID: CVE-2026-54679)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service or execute arbitrary code.
The vulnerability exists due to integer overflow leading to a heap-based buffer overflow in jvp_string_append when appending data to strings on 32-bit systems. A local user can supply crafted input that triggers oversized string growth calculations to cause a denial of service or execute arbitrary code.
Only 32-bit systems are affected.
Remediation
Install update from vendor's website.