DeutschShown in its original language — a full translation is planned for a future version.
jq: Mehrere Schwachstellen
view advisory published 2026-05-11
Ein Angreifer kann mehrere Schwachstellen in jq ausnutzen, um einen Denial of Service Angriff durchzuführen, Daten zu manipulieren oder andere, nicht näher spezifizierte Auswirkungen zu erreichen.
01
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-44777US | medium5.5 | — | ||
jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two
otherwise valid modules include each other. | ||||
| CVE-2026-41257US | medium5.5 | — | ||
jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deepl… | ||||
| CVE-2026-41256US | — | — | ||
jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A… | ||||
| CVE-2026-40612US | medium5.5 | — | ||
jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects with no depth limit. With a sufficiently nested input structure (built pr… | ||||
02
references
External citations — patches, advisories, analysis.
- Meinberg Security Advisory MBGSA-2026.05 vom 2026-07-21external
- Red Hat Security Advisory RHSA-2026:29986 vom 2026-06-25external
- jq GitHub vom 2026-05-11external
- jq GitHub vom 2026-05-11external
- jq GitHub vom 2026-05-11external
- jq GitHub vom 2026-05-11external
- Debian Security Advisory DLA-4599 vom 2026-05-25external
- Debian Security Advisory DLA-4662 vom 2026-07-01external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan