FEDORA-2026-0eb8e878b6 — security update for jq

stable

jq-1.8.1-3.fc44

FEDORA-2026-0eb8e878b6 created by jonathanspw 4 months ago for Fedora 44

Fixes CVE-2026-32316 Fixes CVE-2026-33947 Fixes CVE-2026-39956 Fixes CVE-2026-39979 Fixes CVE-2026-40164

Fixes <skipped: too deep> bug https://github.com/jqlang/jq/issues/3413

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2026-0eb8e878b6

This update has been submitted for testing by jonathanspw.

4 months ago

This update's test gating status has been changed to 'waiting'.

4 months ago

This update's test gating status has been changed to 'passed'.

4 months ago

This update has been pushed to testing.

4 months ago

bojan commented & provided feedback 4 months ago

karma

Works.

filiperosset commented & provided feedback 4 months ago

karma

no regressions noted

This update can be pushed to stable now if the maintainer wishes

4 months ago

geraldosimiao provided feedback 4 months ago

karma

This update has been submitted for stable by bodhi.

There is an ongoing freeze; this will be pushed to stable after the freeze is over.

4 months ago

derekenz commented & provided feedback 4 months ago

karma

Works

This update has been pushed to stable.

4 months ago

Please log in to add feedback.

Metadata

Type

security

Severity

high

Karma

Signed

Content Type

RPM

Test Gating

passed

Autopush Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

14 days

Dates

submitted

4 months ago

in testing

4 months ago

in stable

4 months ago

approved

4 months ago

Builds

jq-1.8.1-3.fc44

BZ#2458029 CVE-2026-32316 jq: jq: Denial of Service or potential arbitrary code execution due to integer overflow and heap-based buffer overflow [fedora-all]

BZ#2458368 CVE-2026-40164 jq: jq: Denial of Service via crafted JSON object causing hash collisions [fedora-all]

BZ#2458400 CVE-2026-39979 jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers [fedora-all]

BZ#2458401 CVE-2026-33947 jq: unbounded Recursion in jv_setpath() / jv_getpath() / delpaths_sorted() [fedora-all]

BZ#2458402 CVE-2026-39956 jq: missing runtime type checks for _strindices lead to crash and limited memory disclosure [fedora-all]

jq-1.8.1-3.fc44

Automated Test Results

passed