Skip to content
OpenAdvisories
High ALAS2023-2026-1860 1 CVE

Important: jq security update (Amazon Linux 2023)

Published Jun 22, 2026 · Updated Jun 22, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-49839: jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2023 jq 0:1.8.1-60.amzn2023
Amazon Linux · 2023 jq-debuginfo 0:1.8.1-60.amzn2023
Amazon Linux · 2023 jq-debugsource 0:1.8.1-60.amzn2023
Amazon Linux · 2023 jq-devel 0:1.8.1-60.amzn2023

Vulnerabilities 1

  • High 7.1
    CVE-2026-49839

    jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow

    jq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds. When jv_load_file(raw=1) reads an attacker-controlled file…

    jqlang jq jq jq Debian Ubuntu Azure Linux Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-49839.html