Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux jq may cause program crash
published 4 months ago
Summary
The jq command-line tool on AlmaLinux can encounter a condition that leads to a memory error, potentially crashing the program. This occurs when the tool processes certain data files and encounters unexpected values. Updating jq and the associated development package to the latest versions will fix the issue and keep your systems stable.
What to do
- Update almalinux jq to version 1.6-14.el9_2.tuxcare.els9.
- Update almalinux jq-devel to version 1.6-14.el9_2.tuxcare.els9.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:AlmaLinux:9.2 | almalinux | jq |
< 1.6-14.el9_2.tuxcare.els9 Fix: upgrade to 1.6-14.el9_2.tuxcare.els9
|
| TuxCare:AlmaLinux:9.2 | almalinux | jq-devel |
< 1.6-14.el9_2.tuxcare.els9 Fix: upgrade to 1.6-14.el9_2.tuxcare.els9
|
Original advisory text
jq: Fix of 2 CVEs
- CVE-2026-49839: break out of the raw file load loop when jv_string_append_buf
returns an invalid value to prevent a heap-buffer-overflow
returns an invalid value to prevent a heap-buffer-overflow
References
- https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1783340505.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-49839 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-54679 Vendor Advisory
Timeline
Published6 Jul 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1783340505 · OSV
Track software like this
Free during beta