Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
yq update fixes security and stability issues
published 3 months ago
Summary
An update is available for yq, a tool used to parse and edit YAML and JSON files. This update fixes two security issues that could allow attackers to gain more privileges, as well as several stability issues that could cause the tool to crash or behave unexpectedly. To stay secure and stable, we recommend installing the latest version of yq.
What to do
- Update suse yq to version 4.53.3-150500.3.12.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | suse | yq |
< 4.53.3-150500.3.12.1 Fix: upgrade to 4.53.3-150500.3.12.1
|
Original advisory text
Security update for yq
This update for yq fixes the following issues:
Update to v4.53.3.
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1267199).
- CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of input containing invalid UTF-8 bytes can lead
to infinite loop (bsc#1271994).
Changes for yq:
- v4.53.3:
* Add --ini-preserve-quotes flag for INI round-trip quote preservation.
* Fix: reset INI decoder state on init.
* Fix: decode properties array bracket paths.
* Fix: preserve floats with trailing zero when encoding YAML to JSON.
* Fix: JSON to TOML root scope and null handling.
* Fix: reset TOML decoder finished flag on Init for multi-doc evaluation.
* Fix: reset TOML decoder between files when evaluating all at once.
* Fix: preserve TOML inline table array scope.
* Fix: preserve empty TOML arrays in tables
* Fix: TOML encoder uses inline tables for YAML FlowStyle mappings.
* Fix nested inline YAML merge explode.
* Fix repeatString overflow test on 32-bit platforms.
Update to v4.53.3.
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1267199).
- CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of input containing invalid UTF-8 bytes can lead
to infinite loop (bsc#1271994).
Changes for yq:
- v4.53.3:
* Add --ini-preserve-quotes flag for INI round-trip quote preservation.
* Fix: reset INI decoder state on init.
* Fix: decode properties array bracket paths.
* Fix: preserve floats with trailing zero when encoding YAML to JSON.
* Fix: JSON to TOML root scope and null handling.
* Fix: reset TOML decoder finished flag on Init for multi-doc evaluation.
* Fix: reset TOML decoder between files when evaluating all at once.
* Fix: preserve TOML inline table array scope.
* Fix: preserve empty TOML arrays in tables
* Fix: TOML encoder uses inline tables for YAML FlowStyle mappings.
* Fix nested inline YAML merge explode.
* Fix repeatString overflow test on 32-bit platforms.
References
- https://www.suse.com/support/update/announcement/2026/suse-su-20263327-1/ Vendor Advisory
- https://bugzilla.suse.com/1267199 Third Party Advisory
- https://bugzilla.suse.com/1271994 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-39821 URL
- https://www.suse.com/security/cve/CVE-2026-56852 URL
Timeline
Published28 Jul 2026
Updated29 Jul 2026
First seen29 Jul 2026
Sources
SUSE-SU-2026:3327-1 · OSV
Track software like this
Free during beta