{"id":"CVE-2015-8863","aliases":["AZL-6504","DEBIAN-CVE-2015-8863","EUVD-2015-8719","GHSA-j4rg-46c3-r5vq","MGASA-2017-0415","RHSA-2016:1098","RHSA-2016:1099","RHSA-2016:1106","SUSE-SU-2026:23873-1","SUSE-SU-2026:4275-1","UBUNTU-CVE-2015-8863","openSUSE-SU-2024:10409-1"],"status":"published","title":"Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a...","description":"Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.07268,"percentile":0.94385,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2016-05-06T17:00:00Z","modified":"2026-09-28T18:26:42Z","fixes":[{"ecosystem":"Azure Linux:2","package":"jq","fixed_in":["1.5-6"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"jq","fixed_in":["1.5+dfsg-1.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jq","fixed_in":["1.5+dfsg-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jq","fixed_in":["1.5+dfsg-1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"jq","fixed_in":["0:1.3-3.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"jq-debuginfo","fixed_in":["0:1.3-3.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"jq","fixed_in":["0:1.3-3.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"jq-debuginfo","fixed_in":["0:1.3-3.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"jq","fixed_in":["0:1.3-3.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"jq-debuginfo","fixed_in":["0:1.3-3.el7ost"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"jq","fixed_in":["1.3-1.1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"jq","fixed_in":["1.5+dfsg-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"jq","fixed_in":["1.5-3.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5+dfsg-1.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5+dfsg-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5+dfsg-1.1"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-1.1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3-3.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"jq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3-3.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3-3.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"jq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3-3.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3-3.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"jq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3-3.el7ost"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3-1.1ubuntu1.1"}]}],"versions":["1.2-8","1.3-1","1.3-1.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5+dfsg-1ubuntu0.1"}]}],"versions":["1.4-2.1","1.5+dfsg-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-3.3"}]}]}],"products":[{"vendor":"jq_project","product":"jq"},{"vendor":"opensuse","product":"leap"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2016-1106.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-1099.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/04/23/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-05/msg00012.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-1098.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802231","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://github.com/stedolan/jq/commit/8eb1367ca44e772963e704a700ef72ae2e12babd","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","report"]},{"url":"https://github.com/stedolan/jq/issues/995","tags":["x_refsource_CONFIRM","x_transferred","report","article"]},{"url":"http://www.openwall.com/lists/oss-security/2016/04/23/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-05/msg00014.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201612-20","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8863","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-j4rg-46c3-r5vq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-8863","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0415.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21923","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2017-10/msg00083.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2016:1098","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1328747","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1098.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8863","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8863","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2016:1099","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1099.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:1106","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1106.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623873-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215737","tags":["report"]},{"url":"https://bugzilla.suse.com/1218034","tags":["report"]},{"url":"https://bugzilla.suse.com/1218038","tags":["report"]},{"url":"https://bugzilla.suse.com/1238078","tags":["report"]},{"url":"https://bugzilla.suse.com/1248600","tags":["report"]},{"url":"https://bugzilla.suse.com/1262043","tags":["report"]},{"url":"https://bugzilla.suse.com/1262044","tags":["report"]},{"url":"https://bugzilla.suse.com/1262072","tags":["report"]},{"url":"https://bugzilla.suse.com/1265060","tags":["report"]},{"url":"https://bugzilla.suse.com/1265061","tags":["report"]},{"url":"https://bugzilla.suse.com/1265062","tags":["report"]},{"url":"https://bugzilla.suse.com/1265070","tags":["report"]},{"url":"https://bugzilla.suse.com/1265071","tags":["report"]},{"url":"https://bugzilla.suse.com/1265075","tags":["report"]},{"url":"https://bugzilla.suse.com/1265076","tags":["report"]},{"url":"https://bugzilla.suse.com/1269220","tags":["report"]},{"url":"https://bugzilla.suse.com/1269221","tags":["report"]},{"url":"https://bugzilla.suse.com/1269390","tags":["report"]},{"url":"https://bugzilla.suse.com/976992","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40612","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54679","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264275-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-8863","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2015-8863","description":"Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.","status":"published","published":"2016-05-06T17:00:00Z","modified":"2024-08-06T08:29:22.09Z","updated_at":"2026-11-02T14:35:41.26549Z"}],"euvd":[{"id":"EUVD-2015-8719","description":"Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.","status":"published","published":"2016-05-06T17:00:00Z","modified":"2024-08-06T08:29:22Z","updated_at":"2026-11-03T01:57:25.869767Z"}],"ghsa":[{"id":"GHSA-j4rg-46c3-r5vq","title":"Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a...","description":"Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.","status":"published","published":"2022-05-14T02:08:03Z","modified":"2023-02-02T05:05:30Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:52:07.660157Z"}],"nvd":[{"id":"CVE-2015-8863","description":"Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.","status":"published","published":"2016-05-06T17:59:03.347Z","modified":"2026-06-17T00:35:23.427Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:16.97467Z"}],"osv":[{"id":"AZL-6504","title":"CVE-2015-8863 affecting package jq for versions less than 1.5-6","description":"Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.","status":"published","published":"2016-05-06T17:59:03Z","modified":"2026-04-21T04:32:39.417994Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:08.076947Z"},{"id":"CVE-2015-8863","description":"Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.","status":"published","published":"2016-05-06T17:59:03Z","modified":"2026-09-28T18:26:42.579548231Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:01.068991Z"},{"id":"DEBIAN-CVE-2015-8863","description":"Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.","status":"published","published":"2016-05-06T17:59:03.347Z","modified":"2026-09-09T07:01:26.37597144Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:27.04239Z"},{"id":"UBUNTU-CVE-2015-8863","description":"Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.","status":"published","published":"2016-05-06T17:59:00Z","modified":"2025-09-08T16:43:31Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:11.100633Z"},{"id":"MGASA-2017-0415","title":"Updated jq packages fix security vulnerabilities","description":"A heap-based buffer overflow flaw was found in jq's tokenadd() function.\nBy tricking a victim into processing a specially crafted JSON file, an\nattacker could use this flaw to crash jq or, potentially, execute\narbitrary code on the victim's system (CVE-2015-8863).\n\nStack exhaustion could affect availability when parsing untrusted input\n(CVE-2016-4074).\n","status":"published","published":"2017-11-19T10:23:35Z","modified":"2026-04-16T06:23:08.911865916Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:10409-1","title":"jq-1.5-3.3 on GA media","description":"These are all security issues fixed in the jq-1.5-3.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:02:36.107071Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"RHSA-2016:1098","title":"Red Hat Security Advisory: jq security update","status":"published","published":"2024-09-13T12:27:51Z","modified":"2026-06-29T10:12:35Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:1099","title":"Red Hat Security Advisory: jq security update","status":"published","published":"2024-09-13T12:27:56Z","modified":"2026-06-29T10:12:36Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:1106","title":"Red Hat Security Advisory: jq security update","status":"published","published":"2024-09-13T12:28:01Z","modified":"2026-06-29T10:12:37Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"SUSE-SU-2026:23873-1","title":"Security update for jq","description":"This update for jq fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2015-8863: heap buffer overflow in tokenadd() function (bsc#976992).\n- CVE-2023-50246: improper memory handling can lead to a heap buffer overflow in `decNumberToString` (bsc#1218034).\n- CVE-2023-50268: stack-based buffer overflow in builds using decNumber (bsc#1218038).\n- CVE-2024-53427: stack-buffer-overflow in the decNumberCopy function in decNumber.c (bsc#1238078).\n- CVE-2025-9403: reachable assertion in run_jq_tests() (bsc#1248600).\n- CVE-2026-32316: denial of Service or potential arbitrary code execution due to integer overflow and heap-based buffer\n  overflow (bsc#1262044).\n- CVE-2026-33948: CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).\n- CVE-2026-40164: predictable hash collisions can lead to a denial of service (bsc#1262072).\n- CVE-2026-40612: jv_contains recurses into nested arrays/objects with no depth limit and can cause a stack overflow\n  (bsc#1265060).\n- CVE-2026-41256: embedded NUL truncates top-level jq programs loaded with -f and can lead to execution of unintended\n  programs (bsc#1265061).\n- CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS (bsc#1265062).\n- CVE-2026-43894: signed integer overflow in `decNumber` can lead to out-of-bounds memory write (bsc#1265070).\n- CVE-2026-43895: embedded NUL bytes in import paths can lead to policy bypass and sensitive information disclosure\n  (bsc#1265071).\n- CVE-2026-43896: unbounded recursion in `jv_object_merge_recursive()` can lead to C stack exhaustion and a process\n  crash (bsc#1265075).\n- CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules `include` each other can lead\n  to stack exhaustion and process crash (bsc#1265076).\n- CVE-2026-47770: stack overflow in deep structural equality (bsc#1269221).\n- CVE-2026-49839: `--rawfile` invalid-state reuse after `String too long` can lead to a heap buffer overflow\n  (bsc#1269220).\n- CVE-2026-54679: integer overflow in `jvp_string_append` can lead to a buffer overrun on 32-bit systems (bsc#1269390).\n\nChanges for jq:\n\nUpdate to version 1.7.1:\n\n * Make the default background color more suitable for bright\n backgrounds.\n * Allow passing the inline jq script after --.\n * Fix possible uninitialised value dereference if jq_init() fails\n * Simplify paths/0 and paths/1.\n * Reject U+001F in string literals.\n * Remove unused nref accumulator in block_bind_library.\n * Remove a bunch of unused variables, and useless assignments.\n * main.c: Remove unused EXIT_STATUS_EXACT option.\n * Actually use the number correctly casted from double to int as\n index.\n * src/builtin.c: remove unnecessary jv_copy-s in\n type_error/type_error2.\n * Remove undefined behavior caught by LLVM 10 UBSAN.\n * Convert decnum to binary64 (double) instead of decimal64.\n This makes jq behave like the JSON specification suggests and\n more similar to other languages.\n * Fix memory leaks on invalid input for ltrimstr/1 and\n rtrimstr/1.\n * Fix memory leak on failed get for setpath/2.\n * Fix nan from json parsing also for nans with payload that\n start with 'n'.\n * Allow carriage return characters in comments.\n * Generate links in the man page.\n * Add extern C for C++.\n * Make object key color configurable using JQ_COLORS environment\n variable.\n * Change the default color of null to Bright Black.\n * Respect NO_COLOR environment variable to disable color output.\n * Improved --help output. Now mentions all options and nicer\n order.\n * Fix multiple issues of exit code using --exit-code/-e option.\n * Add --raw-output0 for NUL (zero byte) separated output.\n * Fix assert crash and validate JSON for --jsonarg.\n * Remove deprecated --argfile option.\n * Use decimal number literals to preserve precision. Comparison\n operations respects precision but arithmetic operations might\n truncate.\n * Adds new builtin pick(stream) to emit a projection of the\n input object or array.\n * Adds new builtin debug(msgs) that works like debug but applies\n a filter on the input before writing to stderr.\n * Adds new builtin scan($re; $flags). Was documented but not\n implemented.\n * Adds new builtin abs to get absolute value. This potentially\n allows the literal value of numbers to be preserved as length\n and fabs convert to float.\n * Allow if without else-branch. When skipped the else-branch\n will be . (identity).\n * Allow use of $binding as key in object literals.\n * Allow dot between chained indexes when using .[\"index\"]\n * Allow dot for chained value iterator .[], .[]?\n * Fix try/catch catches more than it should.\n * Speed up and refactor some builtins, also remove\n scalars_or_empty/0.\n * Now halt and halt_error exit immediately instead of continuing\n to the next input.\n * Fix issue converting string to number after previous convert\n error.\n * Fix issue representing large numbers on some platforms causing\n invalid JSON output.\n * Fix deletion using assigning empty against arrays.\n * Allow keywords to be used as binding name in more places.\n * Allow using nan as NaN in JSON.\n * Expose a module's function names in modulemeta.\n * Fix contains/1 to handle strings with NUL.\n * Fix stderr/0 to output raw text without any decoration.\n * Fix nth/2 to emit empty on index out of range.\n * Fix implode to not assert and instead replace invalid unicode\n codepoints.\n * Fix indices/1 and rindex/1 in case of overlapping matches in\n strings.\n * Fix sub/3 to resolve issues involving global search-and-replace\n (gsub) operations.\n * Fix empty regular expression matches.\n * Fix overflow exception of the modulo operator.\n * Fix string multiplication by 0 (and less than 1) to emit empty\n string.\n * Fix segfault when using libjq and threads.\n * Fix constant folding of division and reminder with zero\n divisor.\n * Fix error/0, error/1 to throw null error.\n * Simpler and faster transpose.\n * Simple and efficient implementation of walk/1.\n * Remove deprecated filters leaf_paths, recurse_down.\n","status":"published","published":"2026-09-17T08:05:35Z","modified":"2026-09-28T18:23:12.243926519Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:4275-1","title":"Security update for jq","description":"This update for jq fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2015-8863: heap buffer overflow in tokenadd() function (bsc#976992).\n- CVE-2023-50246: improper memory handling can lead to a heap buffer overflow in `decNumberToString` (bsc#1218034).\n- CVE-2023-50268: stack-based buffer overflow in builds using decNumber (bsc#1218038).\n- CVE-2024-53427: stack-buffer-overflow in the decNumberCopy function in decNumber.c (bsc#1238078).\n- CVE-2025-9403: reachable assertion in run_jq_tests() (bsc#1248600).\n- CVE-2026-33948: CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).\n- CVE-2026-40164: predictable hash collisions can lead to a denial of service (bsc#1262072).\n- CVE-2026-40612: jv_contains recurses into nested arrays/objects with no depth limit and can cause a stack overflow\n  (bsc#1265060).\n- CVE-2026-41256: embedded NUL truncates top-level jq programs loaded with -f and can lead to execution of unintended\n  programs (bsc#1265061).\n- CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS (bsc#1265062).\n- CVE-2026-43894: signed integer overflow in `decNumber` can lead to out-of-bounds memory write (bsc#1265070).\n- CVE-2026-43895: embedded NUL bytes in import paths can lead to policy bypass and sensitive information disclosure\n  (bsc#1265071).\n- CVE-2026-43896: unbounded recursion in `jv_object_merge_recursive()` can lead to C stack exhaustion and a process\n  crash (bsc#1265075).\n- CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules `include` each other can lead\n  to stack exhaustion and process crash (bsc#1265076).\n- CVE-2026-47770: stack overflow in deep structural equality (bsc#1269221).\n- CVE-2026-49839: `--rawfile` invalid-state reuse after `String too long` can lead to a heap buffer overflow\n  (bsc#1269220).\n- CVE-2026-54679: integer overflow in `jvp_string_append` can lead to a buffer overrun on 32-bit systems (bsc#1269390).\n\nChanges for jq:\n\nUpdate to version 1.7.1:\n\n * Make the default background color more suitable for bright\n backgrounds.\n * Allow passing the inline jq script after --.\n * Fix possible uninitialised value dereference if jq_init() fails\n * Simplify paths/0 and paths/1.\n * Reject U+001F in string literals.\n * Remove unused nref accumulator in block_bind_library.\n * Remove a bunch of unused variables, and useless assignments.\n * main.c: Remove unused EXIT_STATUS_EXACT option.\n * Actually use the number correctly casted from double to int as\n index.\n * src/builtin.c: remove unnecessary jv_copy-s in\n type_error/type_error2.\n * Remove undefined behavior caught by LLVM 10 UBSAN.\n * Convert decnum to binary64 (double) instead of decimal64.\n This makes jq behave like the JSON specification suggests and\n more similar to other languages.\n * Fix memory leaks on invalid input for ltrimstr/1 and\n rtrimstr/1.\n * Fix memory leak on failed get for setpath/2.\n * Fix nan from json parsing also for nans with payload that\n start with 'n'.\n * Allow carriage return characters in comments.\n * Generate links in the man page.\n * Add extern C for C++.\n * Make object key color configurable using JQ_COLORS environment\n variable.\n * Change the default color of null to Bright Black.\n * Respect NO_COLOR environment variable to disable color output.\n * Improved --help output. Now mentions all options and nicer\n order.\n * Fix multiple issues of exit code using --exit-code/-e option.\n * Add --raw-output0 for NUL (zero byte) separated output.\n * Fix assert crash and validate JSON for --jsonarg.\n * Remove deprecated --argfile option.\n * Use decimal number literals to preserve precision. Comparison\n operations respects precision but arithmetic operations might\n truncate.\n * Adds new builtin pick(stream) to emit a projection of the\n input object or array.\n * Adds new builtin debug(msgs) that works like debug but applies\n a filter on the input before writing to stderr.\n * Adds new builtin scan($re; $flags). Was documented but not\n implemented.\n * Adds new builtin abs to get absolute value. This potentially\n allows the literal value of numbers to be preserved as length\n and fabs convert to float.\n * Allow if without else-branch. When skipped the else-branch\n will be . (identity).\n * Allow use of $binding as key in object literals.\n * Allow dot between chained indexes when using .['index']\n * Allow dot for chained value iterator .[], .[]?\n * Fix try/catch catches more than it should.\n * Speed up and refactor some builtins, also remove\n scalars_or_empty/0.\n * Now halt and halt_error exit immediately instead of continuing\n to the next input.\n * Fix issue converting string to number after previous convert\n error.\n * Fix issue representing large numbers on some platforms causing\n invalid JSON output.\n * Fix deletion using assigning empty against arrays.\n * Allow keywords to be used as binding name in more places.\n * Allow using nan as NaN in JSON.\n * Expose a module's function names in modulemeta.\n * Fix contains/1 to handle strings with NUL.\n * Fix stderr/0 to output raw text without any decoration.\n * Fix nth/2 to emit empty on index out of range.\n * Fix implode to not assert and instead replace invalid unicode\n codepoints.\n * Fix indices/1 and rindex/1 in case of overlapping matches in\n strings.\n * Fix sub/3 to resolve issues involving global search-and-replace\n (gsub) operations.\n * Fix empty regular expression matches.\n * Fix overflow exception of the modulo operator.\n * Fix string multiplication by 0 (and less than 1) to emit empty\n string.\n * Fix segfault when using libjq and threads.\n * Fix constant folding of division and reminder with zero\n divisor.\n * Fix error/0, error/1 to throw null error.\n * Simpler and faster transpose.\n * Simple and efficient implementation of walk/1.\n * Remove deprecated filters leaf_paths, recurse_down.\n","status":"published","published":"2026-09-21T07:33:03Z","modified":"2026-09-21T17:15:07.382382398Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}