The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4599 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4599-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                  Andreans Henriksson     May 25, 2026                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : jq     Version        : 1.6-2.1+deb11u2     CVE ID         : CVE-2026-32316 CVE-2026-33947 CVE-2026-33948 CVE-2026-39956                      CVE-2026-39979 CVE-2026-40164 CVE-2026-41256 CVE-2026-41257                      CVE-2026-43895 CVE-2026-43896 CVE-2026-44777     Debian Bug     : 1136445

    It was found that jq, a lightweight and flexible command-line JSON parser, was     vulnerable to multiple memory corruption attacks, which could lead to     application crashes, denial-of-service conditions, and potentially arbitrary     code execution through heap corruption when parsing untrusted input.

    For Debian 11 bullseye, these problems have been fixed in version     1.6-2.1+deb11u2.

    We recommend that you upgrade your jq packages.

    For the detailed security status of jq please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/jq

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779273835 advisory.

  - jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used     MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table     operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON     object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n),     turning any jq expression into an O(n) operation and causing significant CPU exhaustion. This affected     common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more     practical to exploit than existing heap overflow issues since it required only a small payload. This issue     has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784. (CVE-2026-40164)

  - jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects     with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since     the JSON parser caps at depth 10000), the C stack is exhausted. (CVE-2026-40612)

  - jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with
    -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as .
    followed by \x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves     jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON     parser path has already been fixed. (CVE-2026-41256)

  - jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its     allocation size in a signed int. When the stack grows beyond 1 GiB (via deeply nested generator forks),     the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with     attacker-influenced offsets. (CVE-2026-41257)

  - jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number     literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The     wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack     buffer, and then writes 715 million 16-bit units (1.4 GiB) at an offset 1.43 GiB below the stack frame.
    The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).
    (CVE-2026-43894)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1421 advisory.

    This advisory aggregates security fixes for the jq SRPM in CIQ LTS 9.6. It addresses 8 CVEs:
    CVE-2026-39979, CVE-2026-40164, CVE-2026-32316, CVE-2026-33947, CVE-2026-33948, and 3 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4662 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4662-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Andreas Henriksson     July 01, 2026                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : jq     Version        : 1.6-2.1+deb12u2     CVE ID         : CVE-2026-32316 CVE-2026-33947 CVE-2026-33948 CVE-2026-39956                      CVE-2026-39979 CVE-2026-40164 CVE-2026-41256 CVE-2026-41257                      CVE-2026-43894 CVE-2026-43895 CVE-2026-43896 CVE-2026-44777                      CVE-2026-47770 CVE-2026-49839 CVE-2026-54679     Debian Bug     : 1133921 1136445

    It was found that jq, a lightweight and flexible command-line JSON parser, was     vulnerable to multiple memory corruption attacks, which could lead to     application crashes, denial-of-service conditions, and potentially arbitrary     code execution through heap corruption when parsing untrusted input.

    For Debian 12 bookworm, these problems have been fixed in version     1.6-2.1+deb12u2.

    For Debian 11 bullseye, these issues have been addressed in DLA-4599-1 and     DLA-4661-1.

    We recommend that you upgrade your jq packages.

    For the detailed security status of jq please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/jq

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the jq package has been released.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779273835 advisory.

  - jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used     MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table     operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON     object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n),     turning any jq expression into an O(n) operation and causing significant CPU exhaustion. This affected     common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more     practical to exploit than existing heap overflow issues since it required only a small payload. This issue     has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784. (CVE-2026-40164)

  - jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects     with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since     the JSON parser caps at depth 10000), the C stack is exhausted. (CVE-2026-40612)

  - jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with
    -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as .
    followed by \x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves     jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON     parser path has already been fixed. (CVE-2026-41256)

  - jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its     allocation size in a signed int. When the stack grows beyond 1 GiB (via deeply nested generator forks),     the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with     attacker-influenced offsets. (CVE-2026-41257)

  - jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number     literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The     wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack     buffer, and then writes 715 million 16-bit units (1.4 GiB) at an offset 1.43 GiB below the stack frame.
    The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).
    (CVE-2026-43894)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1420 advisory.

    This advisory aggregates security fixes for the jq SRPM in CIQ LTS 9.2. It addresses 8 CVEs:
    CVE-2026-39979, CVE-2026-40164, CVE-2026-32316, CVE-2026-33947, CVE-2026-33948, and 3 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
316545	Debian dla-4599 : jq - security update	Nessus	Debian Local Security Checks	2026/5/25	2026/7/15	high
362050	Rocky Linux 9.6 [TuxCare] Security Update: jq / jq-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1779273835)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
357247	Rocky Linux 9.6 [CIQ] Security Update: jq / jq-devel Multiple Vulnerabilities (ciqsa-2026_1421)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium
324575	Debian dla-4662 : jq - security update	Nessus	Debian Local Security Checks	2026/7/1	2026/7/15	high
335105	Photon OS 5.0: Jq PHSA-2026-5.0-92-0885	Nessus	PhotonOS Local Security Checks	2026/8/13	2026/8/13	high
362358	AlmaLinux 9.6 [TuxCare] Security Update: jq / jq-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1779273835)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/1	high
356473	Rocky Linux 9.2 [CIQ] Security Update: jq / jq-devel Multiple Vulnerabilities (ciqsa-2026_1420)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium

检测

插件搜索

high

high

medium

high

high

high

medium