{"id":"SUSE-SU-2026:22597-1","summary":"Security update for jq","details":"This update for jq fixes the following issues\n\n- CVE-2026-43896: unbounded recursion in jv_object_merge_recursive() can lead to C stack exhaustion and a process crash (bsc#1265075).\n- CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules `include` each other can lead to stack exhaustion and process crash (bsc#1265076).\n- CVE-2026-49839: fixed a bug where jq --rawfile can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds (bsc#1269220).\n- CVE-2026-54679: integer overflow in jvp_string_append can lead to a buffer overrun on 32-bit systems (bsc#1269390).\n","modified":"2026-07-16T18:24:04.413880910Z","published":"2026-07-13T10:29:49Z","related":["CVE-2026-43896","CVE-2026-44777","CVE-2026-49839","CVE-2026-54679"],"upstream":["CVE-2026-43896","CVE-2026-44777","CVE-2026-49839","CVE-2026-54679"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622597-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1265075"},{"type":"REPORT","url":"https://bugzilla.suse.com/1265076"},{"type":"REPORT","url":"https://bugzilla.suse.com/1269220"},{"type":"REPORT","url":"https://bugzilla.suse.com/1269390"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-43896"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-44777"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-49839"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-54679"}],"affected":[{"package":{"name":"jq","ecosystem":"SUSE:Linux Micro 6.2","purl":"pkg:rpm/suse/jq&distro=SUSE%20Linux%20Micro%206.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-160000.4.1"}]}],"ecosystem_specific":{"binaries":[{"jq":"1.7.1-160000.4.1","libjq1":"1.7.1-160000.4.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:22597-1.json"}}],"schema_version":"1.7.5"}