Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 442
Alerts This Week
Warning Icon 1 442

SUSE jq Important Denial of Service Buffer Overflow Vuln 2026-22664-1

suse
Calendar Grey July 20, 2026
Scroller Suse
A security update for jq addresses multiple vulnerabilities to improve system security and stability. Install now!
A security update for jq addresses ten vulnerabilities in SUSE Linux Micro 6.1, including issues related to integer overflows, recursion limits, and improper input handling.

Summary

## This update for jq fixes the following issues: * CVE-2026-32316: integer overflow within the `jvp_string_append()` and `jvp_string_copy_replace_bad` functions can lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044). * CVE-2026-33947: unbounded recursion in functions `jv_setpath()`, `jv_getpath()`, and `delpaths_sorted()` can lead to excessive resource consumption when processing crafted JSON input (bsc#1262069). * CVE-2026-39956: missing runtime type checks in `_strindices` and `jv_string_indexes()` can lead to a crash when evaluating untrusted jq filters against a release build (bsc#1262070). * CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in `jv_parse_sized` can lead to an out-of-bounds read when processing

Topics%20covered

Topics Covered

security advisory denial of service buffer overflow SuSE important jq

References

* bsc#1262043

* bsc#1262044

* bsc#1262069

* bsc#1262070

* bsc#1262071

* bsc#1262072

* bsc#1265060

* bsc#1265061

* bsc#1265062

* bsc#1265070

Cross-

* CVE-2026-32316

* CVE-2026-33947

* CVE-2026-33948

* CVE-2026-39956

* CVE-2026-39979

* CVE-2026-40164

* CVE-2026-40612

* CVE-2026-41256

* CVE-2026-41257

* CVE-2026-43894

CVSS scores:

* CVE-2026-32316 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H

* CVE-2026-32316 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2026-32316 ( NVD ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

* CVE-2026-33947 ( SUSE ): 6.8

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

* CVE-2026-33947 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2026:22664-1
Release Date: 2026-07-03T12:16:11Z
Rating: important

Topics%20covered

Topics Covered

security advisory denial of service buffer overflow SuSE important jq

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.