{"id":"CVE-2026-41256","aliases":["ALPINE-CVE-2026-41256","AZL-86384","BELL-CVE-2026-41256","CLSA-2026-1779123410","CLSA-2026-1779273835","DEBIAN-CVE-2026-41256","EUVD-2026-29162","GHSA-vf2h-chrj-q3fg","MGASA-2026-0535","OESA-2026-2424","OESA-2026-2425","OESA-2026-2426","OESA-2026-2427","OESA-2026-2487","RHSA-2026:29986","SUSE-SU-2026:22545-1","SUSE-SU-2026:22566-1","SUSE-SU-2026:22664-1","SUSE-SU-2026:23873-1","SUSE-SU-2026:4275-1","UBUNTU-CVE-2026-41256","openSUSE-SU-2026:10850-1","openSUSE-SU-2026:21248-1"],"status":"published","title":"jq: Embedded NUL truncates top-level jq programs loaded with -f","description":"jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \\x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00158,"percentile":0.05,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-158"],"published":"2026-05-11T17:18:30Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"jq","fixed_in":["1.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"jq","fixed_in":["1.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"jq","fixed_in":["1.8.2-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"jq","fixed_in":["1.7.1-6"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"jq","fixed_in":["1.8.1-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"jq","fixed_in":["1.8.1-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"jq","fixed_in":["1.8.1-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"jq","fixed_in":["1.6-2.1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jq","fixed_in":["1.7.1-6+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jq","fixed_in":["1.8.1-6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-6"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6-r2"},{"fixed":"1.8.1-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.1-r0"},{"fixed":"1.8.1-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6-r1"},{"fixed":"1.8.1-r1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-14.el9.tuxcare.els6"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"jq-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-14.el9.tuxcare.els6"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-17.el9_6.2.tuxcare.els3"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"jq-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-17.el9_6.2.tuxcare.els3"}]}],"bundled":8},{"source":"osv","ecosystem":"Debian:12","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-2.1+deb12u2"}]}],"versions":["1.6-2.1","1.6-2.1+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-6+deb13u3"}]}],"versions":["1.7.1-6+deb13u1","1.7.1-6+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-6"}]}],"versions":["1.8.0-1","1.8.1-1","1.8.1-2","1.8.1-3","1.8.1-4","1.8.1-5"]},{"source":"osv","ecosystem":"Mageia:10","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-1.mga10"}]}],"bundled":9},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-4.oe2003sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-4.oe2203sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-4.oe2403"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-4.oe2403sp3"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-4.oe2403sp1"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.2-0.1.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"jq-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.2-0.1.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-160000.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-160000.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-160000.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-slfo.1.1_3.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-8","1.3-1","1.3-1.1ubuntu1","1.3-1.1ubuntu1.1","1.3-1.1ubuntu1.1+esm3","1.3-1.1ubuntu1.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-2.1","1.5+dfsg-1","1.5+dfsg-1ubuntu0.1","1.5+dfsg-1ubuntu0.1+esm2","1.5+dfsg-1ubuntu0.1+esm3","1.5+dfsg-1ubuntu0.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5+dfsg-2","1.5+dfsg-2ubuntu0.1~esm1","1.5+dfsg-2ubuntu0.1~esm2","1.5+dfsg-2ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5+dfsg-2build1","1.6-1","1.6-1ubuntu0.20.04.1","1.6-1ubuntu0.20.04.1+esm1","1.6-1ubuntu0.20.04.1+esm2","1.6-1ubuntu0.20.04.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-2.1ubuntu2","1.6-2.1ubuntu3","1.6-2.1ubuntu3.1","1.6-2.1ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-3","1.7-1","1.7.1-2","1.7.1-3","1.7.1-3build1","1.7.1-3ubuntu0.24.04.1","1.7.1-3ubuntu0.24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.1-3ubuntu1","1.7.1-6ubuntu1","1.8.1-3ubuntu1","1.8.1-3ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.1-4ubuntu1","1.8.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.1-3ubuntu1","1.8.1-4ubuntu1","1.8.1-4ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-3.1"}]}],"bundled":13},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-160000.3.1"}]}],"bundled":11}],"products":[{"vendor":"jqlang","product":"jq"}],"references":[{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-vf2h-chrj-q3fg","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","article","report"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-41256","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41256","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-41256","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1779123410.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1779273835.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41256.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-41256","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0535.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35785","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/R2ZT3O453YX2G4PIOLGAVJX45WHP37RM/","tags":["web"]},{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-cfh2-vwfq-qfmm","tags":["advisory","article"]},{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-29gj-222p-j7vx","tags":["advisory","article"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/07/msg00003.html","tags":["web"]},{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-4jm8-m363-4539","tags":["advisory","article"]},{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-5v7p-2r57-2g4g","tags":["advisory","article"]},{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-7q7g-mrq3-phxr","tags":["advisory","article"]},{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-mg96-6h3q-g846","tags":["advisory","article"]},{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-rmpv-jgvr-wpr9","tags":["advisory","article"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00327.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2424","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40612","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41257","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43894","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43895","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43896","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44777","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2425","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2426","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2427","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2487","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:29986","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-43895","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41256","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41257","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-43896","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40612","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-47770","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54679","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-43894","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-49839","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44777","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_29986.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2469183","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40612","tags":["advisory"]},{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-r7m6-x9c7-h69j","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2469193","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41256","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2469187","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41257","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2469175","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43894","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2469199","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43895","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2469184","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43896","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2469192","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44777","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493034","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47770","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47770","tags":["advisory"]},{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-3pgx-frr7-3jxp","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493020","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49839","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49839","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493030","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54679","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622545-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1244116","tags":["report"]},{"url":"https://bugzilla.suse.com/1262043","tags":["report"]},{"url":"https://bugzilla.suse.com/1262044","tags":["report"]},{"url":"https://bugzilla.suse.com/1262069","tags":["report"]},{"url":"https://bugzilla.suse.com/1262070","tags":["report"]},{"url":"https://bugzilla.suse.com/1262071","tags":["report"]},{"url":"https://bugzilla.suse.com/1262072","tags":["report"]},{"url":"https://bugzilla.suse.com/1265060","tags":["report"]},{"url":"https://bugzilla.suse.com/1265061","tags":["report"]},{"url":"https://bugzilla.suse.com/1265062","tags":["report"]},{"url":"https://bugzilla.suse.com/1265070","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40612","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43894","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622566-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622664-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623873-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215737","tags":["report"]},{"url":"https://bugzilla.suse.com/1218034","tags":["report"]},{"url":"https://bugzilla.suse.com/1218038","tags":["report"]},{"url":"https://bugzilla.suse.com/1238078","tags":["report"]},{"url":"https://bugzilla.suse.com/1248600","tags":["report"]},{"url":"https://bugzilla.suse.com/1265071","tags":["report"]},{"url":"https://bugzilla.suse.com/1265075","tags":["report"]},{"url":"https://bugzilla.suse.com/1265076","tags":["report"]},{"url":"https://bugzilla.suse.com/1269220","tags":["report"]},{"url":"https://bugzilla.suse.com/1269221","tags":["report"]},{"url":"https://bugzilla.suse.com/1269390","tags":["report"]},{"url":"https://bugzilla.suse.com/976992","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54679","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264275-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-41256","tags":["report"]},{"url":"https://github.com/jqlang/jq/commit/5a015deae35d19e3ebbc65db6c157a80e76df738","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-41256","title":"jq: Embedded NUL truncates top-level jq programs loaded with -f","description":"jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \\x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.","status":"published","published":"2026-05-11T17:18:30.975Z","modified":"2026-06-23T15:51:43.506Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-158"],"updated_at":"2026-11-02T13:41:08.498858Z"}],"euvd":[{"id":"EUVD-2026-29162","description":"jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \\x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.","status":"published","published":"2026-05-11T17:18:30Z","modified":"2026-06-23T15:51:43Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:32.768333Z"}],"nvd":[{"id":"CVE-2026-41256","description":"jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \\x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.","status":"published","published":"2026-05-11T18:16:33.983Z","modified":"2026-10-26T18:10:00.173Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-158"],"updated_at":"2026-11-02T14:12:18.239974Z"}],"osv":[{"id":"ALPINE-CVE-2026-41256","description":"jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \\x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.","status":"published","published":"2026-05-11T18:16:33.983Z","modified":"2026-10-01T02:17:49.284229019Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-41256","status":"published","published":"2026-05-15T06:09:30.276926Z","modified":"2026-06-13T07:15:07.679976105Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:23.844435Z"},{"id":"CVE-2026-41256","title":"jq: Embedded NUL truncates top-level jq programs loaded with -f","description":"jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \\x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.","status":"published","published":"2026-05-11T17:18:30.975Z","modified":"2026-10-28T02:30:23.776087188Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-158"],"updated_at":"2026-11-02T15:45:03.764807Z"},{"id":"DEBIAN-CVE-2026-41256","description":"jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \\x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.","status":"published","published":"2026-05-11T18:16:33.983Z","modified":"2026-10-27T09:47:29.383298594Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"OESA-2026-2424","title":"jq security update","description":"jq is a lightweight and flexible command-line JSON processor. you can use it to slice and filter and map and transform structured data. It is written in portable C, and it has zero runtime dependencies. it can mangle the data format that you have into the one that you want.\r\n\r\nSecurity Fix(es):\n\njq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since the JSON parser caps at depth 10000), the C stack is exhausted.(CVE-2026-40612)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \\x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.(CVE-2026-41256)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM\u0026apos;s data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.(CVE-2026-41257)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack buffer, and then writes ≈715 million 16-bit units (≈1.4 GiB) at an offset 1.43 GiB below the stack frame. The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).(CVE-2026-43894)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens.(CVE-2026-43895)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects.(CVE-2026-43896)\n\njq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two\notherwise valid modules include each other.(CVE-2026-44777)","status":"published","published":"2026-05-22T11:11:23Z","modified":"2026-08-18T01:20:00.425710407Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2425","title":"jq security update","description":"jq is a lightweight and flexible command-line JSON processor. you can use it to slice and filter and map and transform structured data. It is written in portable C, and it has zero runtime dependencies. it can mangle the data format that you have into the one that you want.\r\n\r\nSecurity Fix(es):\n\njq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since the JSON parser caps at depth 10000), the C stack is exhausted.(CVE-2026-40612)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \\x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.(CVE-2026-41256)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM\u0026apos;s data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.(CVE-2026-41257)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack buffer, and then writes ≈715 million 16-bit units (≈1.4 GiB) at an offset 1.43 GiB below the stack frame. The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).(CVE-2026-43894)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens.(CVE-2026-43895)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects.(CVE-2026-43896)\n\njq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two\notherwise valid modules include each other.(CVE-2026-44777)","status":"published","published":"2026-05-22T11:11:23Z","modified":"2026-08-18T01:20:00.44297185Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2426","title":"jq security update","description":"jq is a lightweight and flexible command-line JSON processor. you can use it to slice and filter and map and transform structured data. It is written in portable C, and it has zero runtime dependencies. it can mangle the data format that you have into the one that you want.\r\n\r\nSecurity Fix(es):\n\njq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since the JSON parser caps at depth 10000), the C stack is exhausted.(CVE-2026-40612)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \\x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.(CVE-2026-41256)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM\u0026apos;s data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.(CVE-2026-41257)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack buffer, and then writes ≈715 million 16-bit units (≈1.4 GiB) at an offset 1.43 GiB below the stack frame. The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).(CVE-2026-43894)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens.(CVE-2026-43895)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects.(CVE-2026-43896)\n\njq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two\notherwise valid modules include each other.(CVE-2026-44777)","status":"published","published":"2026-05-22T11:11:23Z","modified":"2026-08-18T01:20:00.475067023Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2427","title":"jq security update","description":"jq is a lightweight and flexible command-line JSON processor. you can use it to slice and filter and map and transform structured data. It is written in portable C, and it has zero runtime dependencies. it can mangle the data format that you have into the one that you want.\r\n\r\nSecurity Fix(es):\n\njq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since the JSON parser caps at depth 10000), the C stack is exhausted.(CVE-2026-40612)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \\x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.(CVE-2026-41256)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM\u0026apos;s data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.(CVE-2026-41257)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack buffer, and then writes ≈715 million 16-bit units (≈1.4 GiB) at an offset 1.43 GiB below the stack frame. The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).(CVE-2026-43894)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens.(CVE-2026-43895)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects.(CVE-2026-43896)\n\njq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two\notherwise valid modules include each other.(CVE-2026-44777)","status":"published","published":"2026-05-22T11:11:23Z","modified":"2026-08-18T01:19:59.586491264Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2487","title":"jq security update","description":"jq is a lightweight and flexible command-line JSON processor. you can use it to slice and filter and map and transform structured data. It is written in portable C, and it has zero runtime dependencies. it can mangle the data format that you have into the one that you want.\r\n\r\nSecurity Fix(es):\n\njq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since the JSON parser caps at depth 10000), the C stack is exhausted.(CVE-2026-40612)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \\x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.(CVE-2026-41256)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM\u0026apos;s data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.(CVE-2026-41257)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack buffer, and then writes ≈715 million 16-bit units (≈1.4 GiB) at an offset 1.43 GiB below the stack frame. The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).(CVE-2026-43894)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens.(CVE-2026-43895)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects.(CVE-2026-43896)\n\njq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two\notherwise valid modules include each other.(CVE-2026-44777)","status":"published","published":"2026-05-29T11:11:26Z","modified":"2026-08-18T01:20:01.040874504Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"RHSA-2026:29986","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-06-27T10:25:25Z","modified":"2026-10-06T10:31:23.056385085Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"UBUNTU-CVE-2026-41256","description":"jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \\x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.","status":"published","published":"2026-05-11T18:16:00Z","modified":"2026-10-17T12:58:14.752380366Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"AZL-86384","title":"CVE-2026-41256 affecting package jq for versions less than 1.7.1-6","description":"jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \\x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.","status":"published","published":"2026-05-11T18:16:33Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.190302Z"},{"id":"CLSA-2026-1779123410","title":"jq: Fix of 8 CVEs","description":"- CVE-2026-40164: randomize hash seed to mitigate hash collision DoS\n- CVE-2026-40612: limit containment check depth\n- CVE-2026-41256: fix NUL truncation in program files loaded with -f\n- CVE-2026-41257: fix signed-int overflow in stack_reallocate\n- CVE-2026-43894: cap numeric literal length to DEC_MAX_DIGITS\n- CVE-2026-43895: reject embedded NUL bytes in module import paths\n- CVE-2026-43896: limit recursive object merge depth\n- CVE-2026-44777: detect circular module imports","status":"published","published":"2026-05-18T16:56:54Z","modified":"2026-06-01T00:32:33.838946098Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779273835","title":"jq: Fix of 8 CVEs","description":"- CVE-2026-40164: randomize hash seed to mitigate hash collision DoS\n- CVE-2026-40612: limit containment check depth\n- CVE-2026-41256: fix NUL truncation in program files loaded with -f\n- CVE-2026-41257: fix signed-int overflow in stack_reallocate\n- CVE-2026-43894: cap numeric literal length to DEC_MAX_DIGITS\n- CVE-2026-43895: reject embedded NUL bytes in module import paths\n- CVE-2026-43896: limit recursive object merge depth\n- CVE-2026-44777: detect circular module imports","status":"published","published":"2026-05-20T10:44:00Z","modified":"2026-06-01T00:32:52.621927574Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"MGASA-2026-0535","title":"Updated jq package fixes security vulnerabilities","description":"Embedded NUL truncates top-level jq programs loaded with -f.\n(CVE-2026-41256)\nSigned-int overflow in `stack_reallocate` (jq VM stack).\n(CVE-2026-41257)\nWild stack write via signed-integer overflow in decNumber D2U() macro.\n(CVE-2026-43894)\nEmbedded NUL in jq import paths causes local redaction-policy bypass and\npreserves sensitive fields in published artifacts. (CVE-2026-43895)\nStack Overflow in Recursive Object Merge. (CVE-2026-43896)\nStack overflow in module loading on mutual `include`. (CVE-2026-44777)\nStack overflow in deep structural equality. (CVE-2026-47770)\njq --rawfile invalid-state reuse after String too long causes\nheap-buffer-overflow. (CVE-2026-49839)\nPotential integer overflow in jvp_string_append. (CVE-2026-54679)\n","status":"published","published":"2026-10-23T05:45:46Z","modified":"2026-10-23T06:01:08.496490839Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:10850-1","title":"jq-1.8.1-3.1 on GA media","description":"These are all security issues fixed in the jq-1.8.1-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-24T00:00:00Z","modified":"2026-05-25T07:45:05.564073704Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:21248-1","title":"Security update for jq","description":"This update for jq fixes the following issues:\n\n- CVE-2025-48060: improper handling of string data in `jv_string_empty` can lead to heap buffer overflow and a crash\n  when processing crafted input (bsc#1244116).\n- CVE-2026-32316: integer overflow within the `jvp_string_append()` and `jvp_string_copy_replace_bad` functions can\n  lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).\n- CVE-2026-33947: unbounded recursion in functions `jv_setpath()`, `jv_getpath()`, and `delpaths_sorted()` can lead to\n  excessive resource consumption when processing crafted JSON input (bsc#1262069).\n- CVE-2026-39956: missing runtime type checks in `_strindices` and `jv_string_indexes()` can lead to a crash when\n  evaluating untrusted jq filters against a release build (bsc#1262070).\n- CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in `jv_parse_sized` can lead to an\n  out-of-bounds read when processing malformed JSON (bsc#1262071).\n- CVE-2026-40164: use of `MurmurHash3` with a hardcoded seed allows pre-computation of key collisions and can lead to a\n  denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).\n- CVE-2026-40612: recursion into nested arrays/objects with no depth limit in `jv_contains` can lead to a C stack\n  exhaustion when processing crafted input (bsc#1265060).\n- CVE-2026-41256: truncation of top-level jq programs loaded with `-f` and can lead to the execution of unintended\n  programs (bsc#1265061).\n- CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS when processing jq\n  bytecode (bsc#1265062).\n- CVE-2026-43894: signed integer overflow in the `decNumberFromString` `D2U()` macro can lead to an out-of-bounds\n  memory write when processing large number literals (bsc#1265070).\n- CVE-2026-33948: improper handling of buffer sizes via `strlen()` instead of `fgets()` in CLI input parsing allows\n  validation bypass via embedded NUL bytes (bsc#1262043).\n","status":"published","published":"2026-07-07T12:32:56Z","modified":"2026-07-09T10:00:11.272938957Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22545-1","title":"Security update for jq","description":"This update for jq fixes the following issues:\n\n- CVE-2025-48060: improper handling of string data in `jv_string_empty` can lead to heap buffer overflow and a crash\n  when processing crafted input (bsc#1244116).\n- CVE-2026-32316: integer overflow within the `jvp_string_append()` and `jvp_string_copy_replace_bad` functions can\n  lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).\n- CVE-2026-33947: unbounded recursion in functions `jv_setpath()`, `jv_getpath()`, and `delpaths_sorted()` can lead to\n  excessive resource consumption when processing crafted JSON input (bsc#1262069).\n- CVE-2026-39956: missing runtime type checks in `_strindices` and `jv_string_indexes()` can lead to a crash when\n  evaluating untrusted jq filters against a release build (bsc#1262070).\n- CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in `jv_parse_sized` can lead to an\n  out-of-bounds read when processing malformed JSON (bsc#1262071).\n- CVE-2026-40164: use of `MurmurHash3` with a hardcoded seed allows pre-computation of key collisions and can lead to a\n  denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).\n- CVE-2026-40612: recursion into nested arrays/objects with no depth limit in `jv_contains` can lead to a C stack\n  exhaustion when processing crafted input (bsc#1265060).\n- CVE-2026-41256: truncation of top-level jq programs loaded with `-f` and can lead to the execution of unintended\n  programs (bsc#1265061).\n- CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS when processing jq\n  bytecode (bsc#1265062).\n- CVE-2026-43894: signed integer overflow in the `decNumberFromString` `D2U()` macro can lead to an out-of-bounds\n  memory write when processing large number literals (bsc#1265070).\n- CVE-2026-33948: improper handling of buffer sizes via `strlen()` instead of `fgets()` in CLI input parsing allows\n  validation bypass via embedded NUL bytes (bsc#1262043).\n","status":"published","published":"2026-07-07T12:32:43Z","modified":"2026-07-14T18:24:37.360228601Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22566-1","title":"Security update for jq","description":"This update for jq fixes the following issues:\n\n- CVE-2025-48060: improper handling of string data in `jv_string_empty` can lead to heap buffer overflow and a crash\n  when processing crafted input (bsc#1244116).\n- CVE-2026-32316: integer overflow within the `jvp_string_append()` and `jvp_string_copy_replace_bad` functions can\n  lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).\n- CVE-2026-33947: unbounded recursion in functions `jv_setpath()`, `jv_getpath()`, and `delpaths_sorted()` can lead to\n  excessive resource consumption when processing crafted JSON input (bsc#1262069).\n- CVE-2026-39956: missing runtime type checks in `_strindices` and `jv_string_indexes()` can lead to a crash when\n  evaluating untrusted jq filters against a release build (bsc#1262070).\n- CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in `jv_parse_sized` can lead to an\n  out-of-bounds read when processing malformed JSON (bsc#1262071).\n- CVE-2026-40164: use of `MurmurHash3` with a hardcoded seed allows pre-computation of key collisions and can lead to a\n  denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).\n- CVE-2026-40612: recursion into nested arrays/objects with no depth limit in `jv_contains` can lead to a C stack\n  exhaustion when processing crafted input (bsc#1265060).\n- CVE-2026-41256: truncation of top-level jq programs loaded with `-f` and can lead to the execution of unintended\n  programs (bsc#1265061).\n- CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS when processing jq\n  bytecode (bsc#1265062).\n- CVE-2026-43894: signed integer overflow in the `decNumberFromString` `D2U()` macro can lead to an out-of-bounds\n  memory write when processing large number literals (bsc#1265070).\n- CVE-2026-33948: improper handling of buffer sizes via `strlen()` instead of `fgets()` in CLI input parsing allows\n  validation bypass via embedded NUL bytes (bsc#1262043).\n","status":"published","published":"2026-07-07T12:32:43Z","modified":"2026-07-15T18:24:12.01568291Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22664-1","title":"Security update for jq","description":"This update for jq fixes the following issues:\n\n- CVE-2026-32316: integer overflow within the `jvp_string_append()` and `jvp_string_copy_replace_bad` functions can\n  lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).\n- CVE-2026-33947: unbounded recursion in functions `jv_setpath()`, `jv_getpath()`, and `delpaths_sorted()` can lead to\n  excessive resource consumption when processing crafted JSON input (bsc#1262069).\n- CVE-2026-39956: missing runtime type checks in `_strindices` and `jv_string_indexes()` can lead to a crash when\n  evaluating untrusted jq filters against a release build (bsc#1262070).\n- CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in `jv_parse_sized` can lead to an\n  out-of-bounds read when processing malformed JSON (bsc#1262071).\n- CVE-2026-40164: use of `MurmurHash3` with a hardcoded seed allows pre-computation of key collisions and can lead to a\n  denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).\n- CVE-2026-40612: recursion into nested arrays/objects with no depth limit in `jv_contains` can lead to a C stack\n  exhaustion when processing crafted input (bsc#1265060).\n- CVE-2026-41256: truncation of top-level jq programs loaded with `-f` and can lead to the execution of unintended\n  programs (bsc#1265061).\n- CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS when processing jq\n  bytecode (bsc#1265062).\n- CVE-2026-43894: signed integer overflow in the `decNumberFromString` `D2U()` macro can lead to an out-of-bounds\n  memory write when processing large number literals (bsc#1265070).\n- CVE-2026-33948: improper handling of buffer sizes via `strlen()` instead of `fgets()` in CLI input parsing allows\n  validation bypass via embedded NUL bytes (bsc#1262043).\n","status":"published","published":"2026-07-03T12:17:50Z","modified":"2026-07-21T18:48:03.033668638Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:23873-1","title":"Security update for jq","description":"This update for jq fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2015-8863: heap buffer overflow in tokenadd() function (bsc#976992).\n- CVE-2023-50246: improper memory handling can lead to a heap buffer overflow in `decNumberToString` (bsc#1218034).\n- CVE-2023-50268: stack-based buffer overflow in builds using decNumber (bsc#1218038).\n- CVE-2024-53427: stack-buffer-overflow in the decNumberCopy function in decNumber.c (bsc#1238078).\n- CVE-2025-9403: reachable assertion in run_jq_tests() (bsc#1248600).\n- CVE-2026-32316: denial of Service or potential arbitrary code execution due to integer overflow and heap-based buffer\n  overflow (bsc#1262044).\n- CVE-2026-33948: CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).\n- CVE-2026-40164: predictable hash collisions can lead to a denial of service (bsc#1262072).\n- CVE-2026-40612: jv_contains recurses into nested arrays/objects with no depth limit and can cause a stack overflow\n  (bsc#1265060).\n- CVE-2026-41256: embedded NUL truncates top-level jq programs loaded with -f and can lead to execution of unintended\n  programs (bsc#1265061).\n- CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS (bsc#1265062).\n- CVE-2026-43894: signed integer overflow in `decNumber` can lead to out-of-bounds memory write (bsc#1265070).\n- CVE-2026-43895: embedded NUL bytes in import paths can lead to policy bypass and sensitive information disclosure\n  (bsc#1265071).\n- CVE-2026-43896: unbounded recursion in `jv_object_merge_recursive()` can lead to C stack exhaustion and a process\n  crash (bsc#1265075).\n- CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules `include` each other can lead\n  to stack exhaustion and process crash (bsc#1265076).\n- CVE-2026-47770: stack overflow in deep structural equality (bsc#1269221).\n- CVE-2026-49839: `--rawfile` invalid-state reuse after `String too long` can lead to a heap buffer overflow\n  (bsc#1269220).\n- CVE-2026-54679: integer overflow in `jvp_string_append` can lead to a buffer overrun on 32-bit systems (bsc#1269390).\n\nChanges for jq:\n\nUpdate to version 1.7.1:\n\n * Make the default background color more suitable for bright\n backgrounds.\n * Allow passing the inline jq script after --.\n * Fix possible uninitialised value dereference if jq_init() fails\n * Simplify paths/0 and paths/1.\n * Reject U+001F in string literals.\n * Remove unused nref accumulator in block_bind_library.\n * Remove a bunch of unused variables, and useless assignments.\n * main.c: Remove unused EXIT_STATUS_EXACT option.\n * Actually use the number correctly casted from double to int as\n index.\n * src/builtin.c: remove unnecessary jv_copy-s in\n type_error/type_error2.\n * Remove undefined behavior caught by LLVM 10 UBSAN.\n * Convert decnum to binary64 (double) instead of decimal64.\n This makes jq behave like the JSON specification suggests and\n more similar to other languages.\n * Fix memory leaks on invalid input for ltrimstr/1 and\n rtrimstr/1.\n * Fix memory leak on failed get for setpath/2.\n * Fix nan from json parsing also for nans with payload that\n start with 'n'.\n * Allow carriage return characters in comments.\n * Generate links in the man page.\n * Add extern C for C++.\n * Make object key color configurable using JQ_COLORS environment\n variable.\n * Change the default color of null to Bright Black.\n * Respect NO_COLOR environment variable to disable color output.\n * Improved --help output. Now mentions all options and nicer\n order.\n * Fix multiple issues of exit code using --exit-code/-e option.\n * Add --raw-output0 for NUL (zero byte) separated output.\n * Fix assert crash and validate JSON for --jsonarg.\n * Remove deprecated --argfile option.\n * Use decimal number literals to preserve precision. Comparison\n operations respects precision but arithmetic operations might\n truncate.\n * Adds new builtin pick(stream) to emit a projection of the\n input object or array.\n * Adds new builtin debug(msgs) that works like debug but applies\n a filter on the input before writing to stderr.\n * Adds new builtin scan($re; $flags). Was documented but not\n implemented.\n * Adds new builtin abs to get absolute value. This potentially\n allows the literal value of numbers to be preserved as length\n and fabs convert to float.\n * Allow if without else-branch. When skipped the else-branch\n will be . (identity).\n * Allow use of $binding as key in object literals.\n * Allow dot between chained indexes when using .[\"index\"]\n * Allow dot for chained value iterator .[], .[]?\n * Fix try/catch catches more than it should.\n * Speed up and refactor some builtins, also remove\n scalars_or_empty/0.\n * Now halt and halt_error exit immediately instead of continuing\n to the next input.\n * Fix issue converting string to number after previous convert\n error.\n * Fix issue representing large numbers on some platforms causing\n invalid JSON output.\n * Fix deletion using assigning empty against arrays.\n * Allow keywords to be used as binding name in more places.\n * Allow using nan as NaN in JSON.\n * Expose a module's function names in modulemeta.\n * Fix contains/1 to handle strings with NUL.\n * Fix stderr/0 to output raw text without any decoration.\n * Fix nth/2 to emit empty on index out of range.\n * Fix implode to not assert and instead replace invalid unicode\n codepoints.\n * Fix indices/1 and rindex/1 in case of overlapping matches in\n strings.\n * Fix sub/3 to resolve issues involving global search-and-replace\n (gsub) operations.\n * Fix empty regular expression matches.\n * Fix overflow exception of the modulo operator.\n * Fix string multiplication by 0 (and less than 1) to emit empty\n string.\n * Fix segfault when using libjq and threads.\n * Fix constant folding of division and reminder with zero\n divisor.\n * Fix error/0, error/1 to throw null error.\n * Simpler and faster transpose.\n * Simple and efficient implementation of walk/1.\n * Remove deprecated filters leaf_paths, recurse_down.\n","status":"published","published":"2026-09-17T08:05:35Z","modified":"2026-09-28T18:23:12.243926519Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:4275-1","title":"Security update for jq","description":"This update for jq fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2015-8863: heap buffer overflow in tokenadd() function (bsc#976992).\n- CVE-2023-50246: improper memory handling can lead to a heap buffer overflow in `decNumberToString` (bsc#1218034).\n- CVE-2023-50268: stack-based buffer overflow in builds using decNumber (bsc#1218038).\n- CVE-2024-53427: stack-buffer-overflow in the decNumberCopy function in decNumber.c (bsc#1238078).\n- CVE-2025-9403: reachable assertion in run_jq_tests() (bsc#1248600).\n- CVE-2026-33948: CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).\n- CVE-2026-40164: predictable hash collisions can lead to a denial of service (bsc#1262072).\n- CVE-2026-40612: jv_contains recurses into nested arrays/objects with no depth limit and can cause a stack overflow\n  (bsc#1265060).\n- CVE-2026-41256: embedded NUL truncates top-level jq programs loaded with -f and can lead to execution of unintended\n  programs (bsc#1265061).\n- CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS (bsc#1265062).\n- CVE-2026-43894: signed integer overflow in `decNumber` can lead to out-of-bounds memory write (bsc#1265070).\n- CVE-2026-43895: embedded NUL bytes in import paths can lead to policy bypass and sensitive information disclosure\n  (bsc#1265071).\n- CVE-2026-43896: unbounded recursion in `jv_object_merge_recursive()` can lead to C stack exhaustion and a process\n  crash (bsc#1265075).\n- CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules `include` each other can lead\n  to stack exhaustion and process crash (bsc#1265076).\n- CVE-2026-47770: stack overflow in deep structural equality (bsc#1269221).\n- CVE-2026-49839: `--rawfile` invalid-state reuse after `String too long` can lead to a heap buffer overflow\n  (bsc#1269220).\n- CVE-2026-54679: integer overflow in `jvp_string_append` can lead to a buffer overrun on 32-bit systems (bsc#1269390).\n\nChanges for jq:\n\nUpdate to version 1.7.1:\n\n * Make the default background color more suitable for bright\n backgrounds.\n * Allow passing the inline jq script after --.\n * Fix possible uninitialised value dereference if jq_init() fails\n * Simplify paths/0 and paths/1.\n * Reject U+001F in string literals.\n * Remove unused nref accumulator in block_bind_library.\n * Remove a bunch of unused variables, and useless assignments.\n * main.c: Remove unused EXIT_STATUS_EXACT option.\n * Actually use the number correctly casted from double to int as\n index.\n * src/builtin.c: remove unnecessary jv_copy-s in\n type_error/type_error2.\n * Remove undefined behavior caught by LLVM 10 UBSAN.\n * Convert decnum to binary64 (double) instead of decimal64.\n This makes jq behave like the JSON specification suggests and\n more similar to other languages.\n * Fix memory leaks on invalid input for ltrimstr/1 and\n rtrimstr/1.\n * Fix memory leak on failed get for setpath/2.\n * Fix nan from json parsing also for nans with payload that\n start with 'n'.\n * Allow carriage return characters in comments.\n * Generate links in the man page.\n * Add extern C for C++.\n * Make object key color configurable using JQ_COLORS environment\n variable.\n * Change the default color of null to Bright Black.\n * Respect NO_COLOR environment variable to disable color output.\n * Improved --help output. Now mentions all options and nicer\n order.\n * Fix multiple issues of exit code using --exit-code/-e option.\n * Add --raw-output0 for NUL (zero byte) separated output.\n * Fix assert crash and validate JSON for --jsonarg.\n * Remove deprecated --argfile option.\n * Use decimal number literals to preserve precision. Comparison\n operations respects precision but arithmetic operations might\n truncate.\n * Adds new builtin pick(stream) to emit a projection of the\n input object or array.\n * Adds new builtin debug(msgs) that works like debug but applies\n a filter on the input before writing to stderr.\n * Adds new builtin scan($re; $flags). Was documented but not\n implemented.\n * Adds new builtin abs to get absolute value. This potentially\n allows the literal value of numbers to be preserved as length\n and fabs convert to float.\n * Allow if without else-branch. When skipped the else-branch\n will be . (identity).\n * Allow use of $binding as key in object literals.\n * Allow dot between chained indexes when using .['index']\n * Allow dot for chained value iterator .[], .[]?\n * Fix try/catch catches more than it should.\n * Speed up and refactor some builtins, also remove\n scalars_or_empty/0.\n * Now halt and halt_error exit immediately instead of continuing\n to the next input.\n * Fix issue converting string to number after previous convert\n error.\n * Fix issue representing large numbers on some platforms causing\n invalid JSON output.\n * Fix deletion using assigning empty against arrays.\n * Allow keywords to be used as binding name in more places.\n * Allow using nan as NaN in JSON.\n * Expose a module's function names in modulemeta.\n * Fix contains/1 to handle strings with NUL.\n * Fix stderr/0 to output raw text without any decoration.\n * Fix nth/2 to emit empty on index out of range.\n * Fix implode to not assert and instead replace invalid unicode\n codepoints.\n * Fix indices/1 and rindex/1 in case of overlapping matches in\n strings.\n * Fix sub/3 to resolve issues involving global search-and-replace\n (gsub) operations.\n * Fix empty regular expression matches.\n * Fix overflow exception of the modulo operator.\n * Fix string multiplication by 0 (and less than 1) to emit empty\n string.\n * Fix segfault when using libjq and threads.\n * Fix constant folding of division and reminder with zero\n divisor.\n * Fix error/0, error/1 to throw null error.\n * Simpler and faster transpose.\n * Simple and efficient implementation of walk/1.\n * Remove deprecated filters leaf_paths, recurse_down.\n","status":"published","published":"2026-09-21T07:33:03Z","modified":"2026-09-21T17:15:07.382382398Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}