Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 584
Alerts This Week
Warning Icon 1 584

SUSE jq Moderate Resource Exhaustion Buffer Overflow Vuln 2026-2983-1

suse
Calendar Grey July 14, 2026
Scroller Suse
Update for jq resolves five vulnerabilities, emphasizing resource exhaustion and buffer overflow risk in SUSE systems.
SUSE has released a security update for jq addressing five vulnerabilities, including potential heap buffer overflows and excessive resource consumption when processing untrusted J...

Summary

## This update for jq fixes the following issues: * CVE-2026-32316: integer overflow within the `jvp_string_append()` and `jvp_string_copy_replace_bad` functions can lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044). * CVE-2026-33947: unbounded recursion in functions `jv_setpath()`, `jv_getpath()`, and `delpaths_sorted()` can lead to excessive resource consumption when processing crafted JSON input (bsc#1262069). * CVE-2026-39956: missing runtime type checks in `_strindices` and `jv_string_indexes()` can lead to a crash when evaluating untrusted jq filters against a release build (bsc#1262070). * CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in `jv_parse_sized` can lead to an out-of-bounds read when processing

Topics%20covered

Topics Covered

security advisory moderate buffer overflow SuSE resource exhaustion jq

References

* bsc#1262044

* bsc#1262069

* bsc#1262070

* bsc#1262071

* bsc#1262072

Cross-

* CVE-2026-32316

* CVE-2026-33947

* CVE-2026-39956

* CVE-2026-39979

* CVE-2026-40164

CVSS scores:

* CVE-2026-32316 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H

* CVE-2026-32316 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2026-32316 ( NVD ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

* CVE-2026-33947 ( SUSE ): 6.8

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

* CVE-2026-33947 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

* CVE-2026-33947 ( NVD ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2026-33947 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

* CVE-2026-39956 ( SUSE ): 6.8

Severity
moderate
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2026:2983-1
Release Date: 2026-07-14T13:19:55Z
Rating: moderate

Topics%20covered

Topics Covered

security advisory moderate buffer overflow SuSE resource exhaustion jq

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.