{"id":"MGASA-2026-0188","summary":"Updated jq packages fix security vulnerabilities","details":"An integer overflow arises when assigning value using an index of\n2147483647, the signed integer limit. This causes a denial of service.\n(CVE-2024-23337)\nIt was discovered that jq did not correctly handle certain string\nconcatenations. An attacker could possibly use this issue to cause a\ndenial of service or execute arbitrary code. (CVE-2026-32316)\nIt was discovered that jq did not correctly handle recursion in certain\ncircumstances. An attacker could possibly use this issue to cause a\ndenial of service. (CVE-2026-33947)\nIt was discovered that jq did not correctly handle improperly terminated\nstrings. An attacker could possibly use this issue to cause a denial of\nservice or execute arbitrary code. (CVE-2026-33948)\nIt was discovered that jq did not correctly handle checking certain\nvariable types. An attacker could possibly use this issue to cause a\ndenial of service or leak sensitive information. (CVE-2026-39956)\nIt was discovered that jq did not correctly handle certain string\nformatting. An attacker could possibly use this issue to leak sensitive\ninformation or cause a denial of service. (CVE-2026-39979)\nIt was discovered that jq used a fixed seed for hash table operations.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2026-40164)\nA heap-buffer-overflow is present in function `jv_string_vfmt` in the\njq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c,\nline 1456 `void* p = malloc(sz); (CVE-2025-48060)\nTop-level jq programs loaded from a file with -f are truncated at the\nfirst embedded NUL byte on current upstream HEAD. A crafted filter file\nsuch as . followed by \\x00 and arbitrary suffix compiles and executes as\nonly the prefix before the NUL. This leaves jq with a\npost-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path\neven though the JSON parser path has already been fixed.\n(CVE-2026-41256)\nThe ordinary module loader recurses without cycle detection when two\notherwise valid modules include each other (CVE-2026-44777)\n","modified":"2026-06-10T05:33:58.122831752Z","published":"2026-06-10T05:07:06Z","upstream":["CVE-2024-23337","CVE-2025-48060","CVE-2026-32316","CVE-2026-33947","CVE-2026-33948","CVE-2026-39956","CVE-2026-39979","CVE-2026-40164"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2026-0188.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=34443"},{"type":"WEB","url":"https://www.openwall.com/lists/oss-security/2026/04/15/8"},{"type":"ADVISORY","url":"https://github.com/jqlang/jq/security/advisories/GHSA-q3h9-m34w-h76f"},{"type":"ADVISORY","url":"https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p"},{"type":"ADVISORY","url":"https://github.com/jqlang/jq/security/advisories/GHSA-32cx-cvvh-2wj9"},{"type":"ADVISORY","url":"https://github.com/jqlang/jq/security/advisories/GHSA-xwrw-4f8h-rjvg"},{"type":"ADVISORY","url":"https://github.com/jqlang/jq/security/advisories/GHSA-6gc3-3g9p-xx28"},{"type":"ADVISORY","url":"https://github.com/jqlang/jq/security/advisories/GHSA-wwj8-gxm6-jc29"},{"type":"ADVISORY","url":"https://github.com/jqlang/jq/security/advisories/GHSA-gf4g-95wj-4q4r"}],"affected":[{"package":{"name":"jq","ecosystem":"Mageia:9","purl":"pkg:rpm/mageia/jq?arch=source&distro=mageia-9"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-3.1.mga9"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2026-0188.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}