The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19365 advisory.

    - Fix CVE-2026-40164 - Denial of Service via crafted JSON object causing hash collisions
    - Fix CVE-2026-39979 out-of-bounds read in jv_parse_sized()

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_19151 advisory.

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)

    * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-2026_1479 advisory.

    This advisory aggregates security fixes for the jq SRPM in CIQ LTS 8.6. It addresses 1 CVE:
    CVE-2026-39979.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:16692 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)

    * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:16252 advisory.

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)
      * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-16252 advisory.

    - Fix CVE-2026-40164 - Denial of Service via crafted JSON object causing hash collisions
    - Fix CVE-2026-39979 out-of-bounds read in jv_parse_sized()

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:18046 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)

    * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:18047 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)

    * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:19151 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)

    * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:19365 advisory.

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)

    * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_16693 advisory.

    * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers     (CVE-2026-39979)

    * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4662 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4662-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Andreas Henriksson     July 01, 2026                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : jq     Version        : 1.6-2.1+deb12u2     CVE ID         : CVE-2026-32316 CVE-2026-33947 CVE-2026-33948 CVE-2026-39956                      CVE-2026-39979 CVE-2026-40164 CVE-2026-41256 CVE-2026-41257                      CVE-2026-43894 CVE-2026-43895 CVE-2026-43896 CVE-2026-44777                      CVE-2026-47770 CVE-2026-49839 CVE-2026-54679     Debian Bug     : 1133921 1136445

    It was found that jq, a lightweight and flexible command-line JSON parser, was     vulnerable to multiple memory corruption attacks, which could lead to     application crashes, denial-of-service conditions, and potentially arbitrary     code execution through heap corruption when parsing untrusted input.

    For Debian 12 bookworm, these problems have been fixed in version     1.6-2.1+deb12u2.

    For Debian 11 bullseye, these issues have been addressed in DLA-4599-1 and     DLA-4661-1.

    We recommend that you upgrade your jq packages.

    For the detailed security status of jq please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/jq

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2983-1 advisory.

    - CVE-2026-32316: integer overflow within the `jvp_string_append()` and `jvp_string_copy_replace_bad`     functions can       lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).
    - CVE-2026-33947: unbounded recursion in functions `jv_setpath()`, `jv_getpath()`, and `delpaths_sorted()`     can lead to       excessive resource consumption when processing crafted JSON input (bsc#1262069).
    - CVE-2026-39956: missing runtime type checks in `_strindices` and `jv_string_indexes()` can lead to a     crash when       evaluating untrusted jq filters against a release build (bsc#1262070).
    - CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in `jv_parse_sized` can lead     to an       out-of-bounds read when processing malformed JSON (bsc#1262071).
    - CVE-2026-40164: use of `MurmurHash3` with a hardcoded seed allows pre-computation of key collisions and     can lead to a       denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1420 advisory.

    This advisory aggregates security fixes for the jq SRPM in CIQ LTS 9.2. It addresses 8 CVEs:
    CVE-2026-39979, CVE-2026-40164, CVE-2026-32316, CVE-2026-33947, CVE-2026-33948, and 3 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
322580	Oracle Linux 9 : jq (ELSA-2026-19365)	Nessus	Oracle Linux Local Security Checks	2026/6/24	2026/7/15	medium
354274	Rocky Linux 10.2 [CIQ] Security Update: jq / jq-debuginfo / jq-debugsource / jq-devel Multiple Vulnerabilities (crlsa-2026_19151)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium
355270	Rocky Linux 8.6 [CIQ] Security Update: jq / jq-debuginfo / jq-debugsource / jq-devel (ciqsa-2026_1479)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium
314383	RHEL 10 : jq (RHSA-2026:16692)	Nessus	Red Hat Local Security Checks	2026/5/13	2026/7/15	medium
314441	AlmaLinux 8 : jq (ALSA-2026:16252)	Nessus	Alma Linux Local Security Checks	2026/5/13	2026/7/15	medium
314456	Oracle Linux 8 : jq (ELSA-2026-16252)	Nessus	Oracle Linux Local Security Checks	2026/5/13	2026/7/15	medium
315142	RHEL 8 : jq (RHSA-2026:18046)	Nessus	Red Hat Local Security Checks	2026/5/18	2026/7/15	medium
315194	RHEL 8 : jq (RHSA-2026:18047)	Nessus	Red Hat Local Security Checks	2026/5/18	2026/7/15	medium
315392	RHEL 10 : jq (RHSA-2026:19151)	Nessus	Red Hat Local Security Checks	2026/5/19	2026/7/15	medium
317425	RockyLinux 9 : jq (RLSA-2026:19365)	Nessus	Rocky Linux Local Security Checks	2026/5/28	2026/7/15	medium
355915	Rocky Linux 9 [CIQ] Security Update: jq / jq-debuginfo / jq-debugsource / jq-devel Multiple Vulnerabilities (crlsa-2026_16693)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium
324575	Debian dla-4662 : jq - security update	Nessus	Debian Local Security Checks	2026/7/1	2026/7/15	high
326932	SUSE SLED15 / SLES15 Security Update : jq (SUSE-SU-2026:2983-1)	Nessus	SuSE Local Security Checks	2026/7/15	2026/7/15	medium
356473	Rocky Linux 9.2 [CIQ] Security Update: jq / jq-devel Multiple Vulnerabilities (ciqsa-2026_1420)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium