{"id":"openSUSE-SU-2026:21318-1","summary":"Security update for jq","details":"This update for jq fixes the following issues\n\n- CVE-2026-43896: unbounded recursion in jv_object_merge_recursive() can lead to C stack exhaustion and a process crash (bsc#1265075).\n- CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules `include` each other can lead to stack exhaustion and process crash (bsc#1265076).\n- CVE-2026-49839: fixed a bug where jq --rawfile can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds (bsc#1269220).\n- CVE-2026-54679: integer overflow in jvp_string_append can lead to a buffer overrun on 32-bit systems (bsc#1269390).\n","modified":"2026-07-15T18:24:23.694683158Z","published":"2026-07-13T10:29:44Z","related":["CVE-2026-43896","CVE-2026-44777","CVE-2026-49839","CVE-2026-54679"],"upstream":["CVE-2026-43896","CVE-2026-44777","CVE-2026-49839","CVE-2026-54679"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1265075"},{"type":"REPORT","url":"https://bugzilla.suse.com/1265076"},{"type":"REPORT","url":"https://bugzilla.suse.com/1269220"},{"type":"REPORT","url":"https://bugzilla.suse.com/1269390"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-43896"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-44777"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-49839"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-54679"}],"affected":[{"package":{"name":"jq","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/jq&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-160000.4.1"}]}],"ecosystem_specific":{"binaries":[{"libjq-devel":"1.7.1-160000.4.1","libjq1":"1.7.1-160000.4.1","jq":"1.7.1-160000.4.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21318-1.json"}}],"schema_version":"1.7.5"}