SUSE-SU-2026:2983-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2026/suse-su-20262983-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2983-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/SUSE-SU-2026:2983-1
Upstream
CVE (5)
Related
CVE (5)
Published
2026-07-14T13:19:54Z
Modified
2026-07-15T10:00:10Z
Summary
Security update for jq
Details

This update for jq fixes the following issues:

  • CVE-2026-32316: integer overflow within the jvp_string_append() and jvp_string_copy_replace_bad functions can lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).
  • CVE-2026-33947: unbounded recursion in functions jv_setpath(), jv_getpath(), and delpaths_sorted() can lead to excessive resource consumption when processing crafted JSON input (bsc#1262069).
  • CVE-2026-39956: missing runtime type checks in _strindices and jv_string_indexes() can lead to a crash when evaluating untrusted jq filters against a release build (bsc#1262070).
  • CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in jv_parse_sized can lead to an out-of-bounds read when processing malformed JSON (bsc#1262071).
  • CVE-2026-40164: use of MurmurHash3 with a hardcoded seed allows pre-computation of key collisions and can lead to a denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).
References

Affected packages

SUSE:Linux Enterprise Micro 5.3
jq

Package

Name
jq
Purl
pkg:rpm/suse/jq&distro=SUSE%20Linux%20Enterprise%20Micro%205.3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.6-150000.3.20.1

Ecosystem specific 

{
    "binaries":  [
        {
            "jq":  "1.6-150000.3.20.1",
            "libjq1":  "1.6-150000.3.20.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2983-1.json"
SUSE:Linux Enterprise Micro 5.4
jq

Package

Name
jq
Purl
pkg:rpm/suse/jq&distro=SUSE%20Linux%20Enterprise%20Micro%205.4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.6-150000.3.20.1

Ecosystem specific 

{
    "binaries":  [
        {
            "jq":  "1.6-150000.3.20.1",
            "libjq1":  "1.6-150000.3.20.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2983-1.json"
SUSE:Linux Enterprise Micro 5.5
jq

Package

Name
jq
Purl
pkg:rpm/suse/jq&distro=SUSE%20Linux%20Enterprise%20Micro%205.5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.6-150000.3.20.1

Ecosystem specific 

{
    "binaries":  [
        {
            "jq":  "1.6-150000.3.20.1",
            "libjq1":  "1.6-150000.3.20.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2983-1.json"
SUSE:Linux Enterprise Module for Basesystem 15 SP7
jq

Package

Name
jq
Purl
pkg:rpm/suse/jq&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.6-150000.3.20.1

Ecosystem specific 

{
    "binaries":  [
        {
            "jq":  "1.6-150000.3.20.1",
            "libjq-devel":  "1.6-150000.3.20.1",
            "libjq1":  "1.6-150000.3.20.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2983-1.json"