SUSE-SU-2026:22664-1

This update for jq fixes the following issues:

• CVE-2026-32316: integer overflow within the jvp_string_append() and jvp_string_copy_replace_bad functions can lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).
• CVE-2026-33947: unbounded recursion in functions jv_setpath(), jv_getpath(), and delpaths_sorted() can lead to excessive resource consumption when processing crafted JSON input (bsc#1262069).
• CVE-2026-39956: missing runtime type checks in _strindices and jv_string_indexes() can lead to a crash when evaluating untrusted jq filters against a release build (bsc#1262070).
• CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in jv_parse_sized can lead to an out-of-bounds read when processing malformed JSON (bsc#1262071).
• CVE-2026-40164: use of MurmurHash3 with a hardcoded seed allows pre-computation of key collisions and can lead to a denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).
• CVE-2026-40612: recursion into nested arrays/objects with no depth limit in jv_contains can lead to a C stack exhaustion when processing crafted input (bsc#1265060).
• CVE-2026-41256: truncation of top-level jq programs loaded with -f and can lead to the execution of unintended programs (bsc#1265061).
• CVE-2026-41257: integer overflow in stack_reallocate can lead to memory corruption and DoS when processing jq bytecode (bsc#1265062).
• CVE-2026-43894: signed integer overflow in the decNumberFromString D2U() macro can lead to an out-of-bounds memory write when processing large number literals (bsc#1265070).
• CVE-2026-33948: improper handling of buffer sizes via strlen() instead of fgets() in CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).