Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.2
jq on Red Hat Linux: Unauthenticated Data Execution
published 5 months ago
Summary
An update is available for jq on Red Hat Linux, which fixes a vulnerability that could allow an attacker to execute code on a system without permission. This affects systems running jq, which is used for parsing and processing JSON data. To stay secure, apply the latest update as soon as possible.
What to do
- Update redhat jq to version 0:1.7.1-11.el10_1.0.2.
- Update redhat jq-debuginfo to version 0:1.7.1-11.el10_1.0.2.
- Update redhat jq-debugsource to version 0:1.7.1-11.el10_1.0.2.
- Update redhat jq-devel to version 0:1.7.1-11.el10_1.0.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:enterprise_linux:10.1 | redhat | jq |
< 0:1.7.1-11.el10_1.0.2 Fix: upgrade to 0:1.7.1-11.el10_1.0.2
|
| Red Hat:enterprise_linux:10.1 | redhat | jq-debuginfo |
< 0:1.7.1-11.el10_1.0.2 Fix: upgrade to 0:1.7.1-11.el10_1.0.2
|
| Red Hat:enterprise_linux:10.1 | redhat | jq-debugsource |
< 0:1.7.1-11.el10_1.0.2 Fix: upgrade to 0:1.7.1-11.el10_1.0.2
|
| Red Hat:enterprise_linux:10.1 | redhat | jq-devel |
< 0:1.7.1-11.el10_1.0.2 Fix: upgrade to 0:1.7.1-11.el10_1.0.2
|
Original advisory text
Red Hat Security Advisory: jq security update
References
- https://access.redhat.com/errata/RHSA-2026:16692 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#important Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2458077 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2458084 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_16692.... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-39979 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-39979 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-39979 Vendor Advisory
- https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f Third Party Advisory
- https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-40164 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-40164 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-40164 Vendor Advisory
- https://github.com/jqlang/jq/commit/0c7d133c3c7e37c00b6d46b658a02244fdd3c784 Third Party Advisory
- https://github.com/jqlang/jq/security/advisories/GHSA-wwj8-gxm6-jc29 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published13 May 2026
Updated13 May 2026
First seen13 May 2026
Sources
RHSA-2026:16692 · OSV
Track software like this
Free during beta