FEDORA-2026-4e57162966 — security update for jq

stable

jq-1.8.1-3.fc43

FEDORA-2026-4e57162966 created by jonathanspw 3 months ago for Fedora 43

Fixes CVE-2026-32316 Fixes CVE-2026-33947 Fixes CVE-2026-39956 Fixes CVE-2026-39979 Fixes CVE-2026-40164

Fixes <skipped: too deep> bug https://github.com/jqlang/jq/issues/3413

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2026-4e57162966

This update has been submitted for testing by jonathanspw.

3 months ago

This update's test gating status has been changed to 'waiting'.

3 months ago

This update's test gating status has been changed to 'waiting'.

3 months ago

This update's test gating status has been changed to 'passed'.

3 months ago

This update has been pushed to testing.

3 months ago

filiperosset commented & provided feedback 3 months ago

karma

no regressions noted

filiperosset commented & provided feedback 3 months ago

karma

no regressions noted

besser82 commented & provided feedback 3 months ago

karma

Works great! LGTM! =)

This update can be pushed to stable now if the maintainer wishes

3 months ago

derekenz commented & provided feedback 3 months ago

karma

Works

This update has been submitted for stable by bodhi.

3 months ago

This update has been pushed to stable.

3 months ago

Please log in to add feedback.

Metadata

Type

security

Severity

high

Karma

Signed

Content Type

RPM

Test Gating

passed

Autopush Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

14 days

Dates

submitted

3 months ago

in testing

3 months ago

in stable

3 months ago

approved

3 months ago

Builds

jq-1.8.1-3.fc43

BZ#2458029 CVE-2026-32316 jq: jq: Denial of Service or potential arbitrary code execution due to integer overflow and heap-based buffer overflow [fedora-all]

BZ#2458368 CVE-2026-40164 jq: jq: Denial of Service via crafted JSON object causing hash collisions [fedora-all]

BZ#2458400 CVE-2026-39979 jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers [fedora-all]

BZ#2458401 CVE-2026-33947 jq: unbounded Recursion in jv_setpath() / jv_getpath() / delpaths_sorted() [fedora-all]

BZ#2458402 CVE-2026-39956 jq: missing runtime type checks for _strindices lead to crash and limited memory disclosure [fedora-all]

jq-1.8.1-3.fc43

Automated Test Results

passed