# SUSE-SU-2026:4275-1: jq security update

SUSE-SU-2026:4275-1, released September 21, 2026, fixes 17 CVEs in jq (version 1.7.1-150000.3.25.1). None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/suse-su-2026-4275-1
- Platform: Linux
- Released: Sep 21, 2026
- Priority: High (Closes CVE-2024-53427, high severity)
- CVEs: 17, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2026:4275-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [jq](https://patchblox.com/security/data/product/linux/jq.md) | sles 15.6 | 1.7.1-150000.3.25.1 |
| [jq](https://patchblox.com/security/data/product/linux/jq.md) | sles 15.7 | 1.7.1-150000.3.25.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2024-53427](https://patchblox.com/security/data/cve/CVE-2024-53427.md) | High | jq: stack-buffer-overflow in the decNumberCopy function in decNumber.c (bsc#1238078). | 8.1 | 0.0039 |  |
| [CVE-2026-40164](https://patchblox.com/security/data/cve/CVE-2026-40164.md) | High | jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seed | 8.2 | 0.0038 |  |
| [CVE-2026-49839](https://patchblox.com/security/data/cve/CVE-2026-49839.md) | High | jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow | 7.1 | 0.0017 |  |
| [CVE-2015-8863](https://patchblox.com/security/data/cve/CVE-2015-8863.md) | Routine | jq: heap buffer overflow in tokenadd() function (bsc#976992). | n/a | 0.0727 |  |
| [CVE-2023-50246](https://patchblox.com/security/data/cve/CVE-2023-50246.md) | Routine | jq: improper memory handling can lead to a heap buffer overflow in `decNumberToString` (bsc#1218034). | 5.5 | 0.0051 |  |
| [CVE-2023-50268](https://patchblox.com/security/data/cve/CVE-2023-50268.md) | Routine | jq: stack-based buffer overflow in builds using decNumber (bsc#1218038). | 5.5 | 0.0044 |  |
| [CVE-2026-33948](https://patchblox.com/security/data/cve/CVE-2026-33948.md) | Routine | jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input | 5.3 | 0.0027 |  |
| [CVE-2025-9403](https://patchblox.com/security/data/cve/CVE-2025-9403.md) | Routine | jqlang jq JSON jq_test.c run_jq_tests assertion | 3.3 | 0.0022 |  |
| [CVE-2026-40612](https://patchblox.com/security/data/cve/CVE-2026-40612.md) | Routine | jq: Stack overflow via unbounded recursion in jv_contains | 5.5 | 0.0016 |  |
| [CVE-2026-44777](https://patchblox.com/security/data/cve/CVE-2026-44777.md) | Routine | jq: stack overflow in module loading on mutual `include` | 5.5 | 0.0016 |  |
| [CVE-2026-43894](https://patchblox.com/security/data/cve/CVE-2026-43894.md) | Routine | jq: Wild stack write via signed-integer overflow in decNumber D2U() macro | 6.2 | 0.0016 |  |
| [CVE-2026-41256](https://patchblox.com/security/data/cve/CVE-2026-41256.md) | Routine | jq: Embedded NUL truncates top-level jq programs loaded with -f | 5.5 | 0.0016 |  |
| [CVE-2026-43895](https://patchblox.com/security/data/cve/CVE-2026-43895.md) | Routine | jq: Embedded NUL in jq import paths causes local redaction-policy bypass and preserves sensitive fields in published artifacts | 4.4 | 0.0016 |  |
| [CVE-2026-43896](https://patchblox.com/security/data/cve/CVE-2026-43896.md) | Routine | jq: Stack Overflow in Recursive Object Merge | 6.2 | 0.0015 |  |
| [CVE-2026-47770](https://patchblox.com/security/data/cve/CVE-2026-47770.md) | Routine | jq: jq is a command-line JSON processor | 5.5 | 0.0015 |  |
| [CVE-2026-54679](https://patchblox.com/security/data/cve/CVE-2026-54679.md) | Routine | jq: potential integer overflow in jvp_string_append | 5.5 | 0.0015 |  |
| [CVE-2026-41257](https://patchblox.com/security/data/cve/CVE-2026-41257.md) | Routine | jq: Signed-int overflow in `stack_reallocate` (jq VM stack) | 5.5 | 0.0014 |  |

---

Data as of 2026-11-11T01:43:54Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.