Linux · SUSE Linux Enterprise · Security advisory · September 21, 2026
SUSE-SU-2026:4275-1: jq security update
SUSE-SU-2026:4275-1, released September 21, 2026, fixes 17 CVEs in jq (version 1.7.1-150000.3.25.1). None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
17
None rated Critical
Exploited
0
None reported
Highest CVSS
8.2
Base score, 0 to 10
Highest EPSS
0.0727
94th percentile
Priority of the 17 CVEs
Patch now 0
Urgent 0
High 3
Routine 14
Fixed package versions
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| High | CVE-2024-53427 | jq: stack-buffer-overflow in the decNumberCopy function in decNumber.c (bsc#1238078). | 8.1 | 0.0039 | None reported |
| High | CVE-2026-40164 | jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seed | 8.2 | 0.0038 | None reported |
| High | CVE-2026-49839 | jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow | 7.1 | 0.0017 | None reported |
| Routine | CVE-2015-8863 | jq: heap buffer overflow in tokenadd() function (bsc#976992). | n/a | 0.0727 | None reported |
| Routine | CVE-2023-50246 | jq: improper memory handling can lead to a heap buffer overflow in `decNumberToString` (bsc#1218034). | 5.5 | 0.0051 | None reported |
| Routine | CVE-2023-50268 | jq: stack-based buffer overflow in builds using decNumber (bsc#1218038). | 5.5 | 0.0044 | None reported |
| Routine | CVE-2026-33948 | jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input | 5.3 | 0.0027 | None reported |
| Routine | CVE-2025-9403 | jqlang jq JSON jq_test.c run_jq_tests assertion | 3.3 | 0.0022 | None reported |
| Routine | CVE-2026-40612 | jq: Stack overflow via unbounded recursion in jv_contains | 5.5 | 0.0016 | None reported |
| Routine | CVE-2026-44777 | jq: stack overflow in module loading on mutual `include` | 5.5 | 0.0016 | None reported |
| Routine | CVE-2026-43894 | jq: Wild stack write via signed-integer overflow in decNumber D2U() macro | 6.2 | 0.0016 | None reported |
| Routine | CVE-2026-41256 | jq: Embedded NUL truncates top-level jq programs loaded with -f | 5.5 | 0.0016 | None reported |
| Routine | CVE-2026-43895 | jq: Embedded NUL in jq import paths causes local redaction-policy bypass and preserves sensitive fields in published artifacts | 4.4 | 0.0016 | None reported |
| Routine | CVE-2026-43896 | jq: Stack Overflow in Recursive Object Merge | 6.2 | 0.0015 | None reported |
| Routine | CVE-2026-47770 | jq: jq is a command-line JSON processor | 5.5 | 0.0015 | None reported |
| Routine | CVE-2026-54679 | jq: potential integer overflow in jvp_string_append | 5.5 | 0.0015 | None reported |
| Routine | CVE-2026-41257 | jq: Signed-int overflow in `stack_reallocate` (jq VM stack) | 5.5 | 0.0014 | None reported |
Showing 1 to 17 of 17
1
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.