The version of CBL-Mariner Releases installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-40164 advisory.

  - jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used     MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table     operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON     object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n),     turning any jq expression into an O(n) operation and causing significant CPU exhaustion. This affected     common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more     practical to exploit than existing heap overflow issues since it required only a small payload. This issue     has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784. (CVE-2026-40164)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-16692 advisory.

    - Fix CVE-2026-40164 - Denial of Service via crafted JSON object causing       hash collisions

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:16252 advisory.

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)

    * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:18040 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)

    * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21248-1 advisory.

    - CVE-2025-48060: improper handling of string data in `jv_string_empty` can lead to heap buffer overflow     and a crash       when processing crafted input (bsc#1244116).
    - CVE-2026-32316: integer overflow within the `jvp_string_append()` and `jvp_string_copy_replace_bad`     functions can       lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).
    - CVE-2026-33947: unbounded recursion in functions `jv_setpath()`, `jv_getpath()`, and `delpaths_sorted()`     can lead to       excessive resource consumption when processing crafted JSON input (bsc#1262069).
    - CVE-2026-39956: missing runtime type checks in `_strindices` and `jv_string_indexes()` can lead to a     crash when       evaluating untrusted jq filters against a release build (bsc#1262070).
    - CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in `jv_parse_sized` can lead     to an       out-of-bounds read when processing malformed JSON (bsc#1262071).
    - CVE-2026-40164: use of `MurmurHash3` with a hardcoded seed allows pre-computation of key collisions and     can lead to a       denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).
    - CVE-2026-40612: recursion into nested arrays/objects with no depth limit in `jv_contains` can lead to a     C stack       exhaustion when processing crafted input (bsc#1265060).
    - CVE-2026-41256: truncation of top-level jq programs loaded with `-f` and can lead to the execution of     unintended       programs (bsc#1265061).
    - CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS when     processing jq       bytecode (bsc#1265062).
    - CVE-2026-43894: signed integer overflow in the `decNumberFromString` `D2U()` macro can lead to an out-     of-bounds       memory write when processing large number literals (bsc#1265070).
    - CVE-2026-33948: improper handling of buffer sizes via `strlen()` instead of `fgets()` in CLI input     parsing allows       validation bypass via embedded NUL bytes (bsc#1262043).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the jq package has been released.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:16252 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)

    * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 11.0.1.3 / AHV-11.0.1.3. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-11.0.1.3 advisory.

  - A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap     corruption, leading to a denial of service or potential code execution via a buffer-underflow in the     GVariant parser when processing maliciously crafted input strings. (CVE-2025-14087)

  - In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a     privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.
    (CVE-2026-35535)

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. In versions 1.2.1 through 1.6.55, `png_set_tRNS` and `png_set_PLTE`     each alias a heap-allocated buffer between `png_struct` and `png_info`, sharing a single allocation across     two structs with independent lifetimes. The `trans_alpha` aliasing has been present since at least libpng     1.0, and the `palette` aliasing since at least 1.2.1. Both affect all prior release lines `png_set_tRNS`     sets `png_ptr->trans_alpha = info_ptr->trans_alpha` (256-byte buffer) and `png_set_PLTE` sets     `info_ptr->palette = png_ptr->palette` (768-byte buffer). In both cases, calling `png_free_data` (with     `PNG_FREE_TRNS` or `PNG_FREE_PLTE`) frees the buffer through `info_ptr` while the corresponding `png_ptr`     pointer remains dangling. Subsequent row-transform functions dereference and, in some code paths, write to     the freed memory. A second call to `png_set_tRNS` or `png_set_PLTE` has the same effect, because both     functions call `png_free_data` internally before reallocating the `info_ptr` buffer. Version 1.6.56 fixes     the issue. (CVE-2026-33416)

  - A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the     client's machine. This issue occurs when files are being copied from a client to a server. During this     process, the rsync server will send checksums of local data to the client to compare with in order to     determine what data needs to be sent to the server. By sending specially constructed checksum values for     arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the     responses from the client. (CVE-2024-12086)

  - A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a     heap based buffer, via a negative array index. The malicious rsync client requires at least read access to     the remote rsync module in order to trigger the issue. (CVE-2025-10158)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:16692 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)

    * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:16252 advisory.

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)
      * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:18047 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)

    * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:19151 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)

    * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:19365 advisory.

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)

    * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:18046 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)

    * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-16252 advisory.

    - Fix CVE-2026-40164 - Denial of Service via crafted JSON object causing hash collisions
    - Fix CVE-2026-39979 out-of-bounds read in jv_parse_sized()

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2983-1 advisory.

    - CVE-2026-32316: integer overflow within the `jvp_string_append()` and `jvp_string_copy_replace_bad`     functions can       lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).
    - CVE-2026-33947: unbounded recursion in functions `jv_setpath()`, `jv_getpath()`, and `delpaths_sorted()`     can lead to       excessive resource consumption when processing crafted JSON input (bsc#1262069).
    - CVE-2026-39956: missing runtime type checks in `_strindices` and `jv_string_indexes()` can lead to a     crash when       evaluating untrusted jq filters against a release build (bsc#1262070).
    - CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in `jv_parse_sized` can lead     to an       out-of-bounds read when processing malformed JSON (bsc#1262071).
    - CVE-2026-40164: use of `MurmurHash3` with a hardcoded seed allows pre-computation of key collisions and     can lead to a       denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4662 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4662-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Andreas Henriksson     July 01, 2026                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : jq     Version        : 1.6-2.1+deb12u2     CVE ID         : CVE-2026-32316 CVE-2026-33947 CVE-2026-33948 CVE-2026-39956                      CVE-2026-39979 CVE-2026-40164 CVE-2026-41256 CVE-2026-41257                      CVE-2026-43894 CVE-2026-43895 CVE-2026-43896 CVE-2026-44777                      CVE-2026-47770 CVE-2026-49839 CVE-2026-54679     Debian Bug     : 1133921 1136445

    It was found that jq, a lightweight and flexible command-line JSON parser, was     vulnerable to multiple memory corruption attacks, which could lead to     application crashes, denial-of-service conditions, and potentially arbitrary     code execution through heap corruption when parsing untrusted input.

    For Debian 12 bookworm, these problems have been fixed in version     1.6-2.1+deb12u2.

    For Debian 11 bullseye, these issues have been addressed in DLA-4599-1 and     DLA-4661-1.

    We recommend that you upgrade your jq packages.

    For the detailed security status of jq please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/jq

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
310264	CBL Mariner 2.0 Security Update: CBL-Mariner Releases (CVE-2026-40164)	Nessus	MarinerOS Local Security Checks	2026/4/25	2026/7/15	high
314462	Oracle Linux 10 : jq (ELSA-2026-16692)	Nessus	Oracle Linux Local Security Checks	2026/5/13	2026/7/15	medium
314687	RockyLinux 8 : jq (RLSA-2026:16252)	Nessus	Rocky Linux Local Security Checks	2026/5/14	2026/7/15	medium
315199	RHEL 10 : jq (RHSA-2026:18040)	Nessus	Red Hat Local Security Checks	2026/5/18	2026/7/15	medium
326028	openSUSE 16 Security Update : jq (openSUSE-SU-2026:21248-1)	Nessus	SuSE Local Security Checks	2026/7/9	2026/7/15	high
328965	Photon OS 5.0: Jq PHSA-2026-5.0-0870	Nessus	PhotonOS Local Security Checks	2026/7/22	2026/7/22	high
328025	RHEL 8 : jq (RHSA-2026:16252)	Nessus	Red Hat Local Security Checks	2026/7/20	2026/7/20	medium
324126	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-11.0.1.3)	Nessus	Misc.	2026/7/1	2026/7/15	critical
314383	RHEL 10 : jq (RHSA-2026:16692)	Nessus	Red Hat Local Security Checks	2026/5/13	2026/7/15	medium
314441	AlmaLinux 8 : jq (ALSA-2026:16252)	Nessus	Alma Linux Local Security Checks	2026/5/13	2026/7/15	medium
315194	RHEL 8 : jq (RHSA-2026:18047)	Nessus	Red Hat Local Security Checks	2026/5/18	2026/7/15	medium
315392	RHEL 10 : jq (RHSA-2026:19151)	Nessus	Red Hat Local Security Checks	2026/5/19	2026/7/15	medium
317425	RockyLinux 9 : jq (RLSA-2026:19365)	Nessus	Rocky Linux Local Security Checks	2026/5/28	2026/7/15	medium
315142	RHEL 8 : jq (RHSA-2026:18046)	Nessus	Red Hat Local Security Checks	2026/5/18	2026/7/15	medium
314456	Oracle Linux 8 : jq (ELSA-2026-16252)	Nessus	Oracle Linux Local Security Checks	2026/5/13	2026/7/15	medium
326932	SUSE SLED15 / SLES15 Security Update : jq (SUSE-SU-2026:2983-1)	Nessus	SuSE Local Security Checks	2026/7/15	2026/7/15	medium
324575	Debian dla-4662 : jq - security update	Nessus	Debian Local Security Checks	2026/7/1	2026/7/15	high

检测

插件搜索

high

medium

medium

medium

high

high

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium

high