Skip to content
OpenAdvisories
High RHSA-2026:29986 10 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Jun 27, 2026 · Updated Oct 6, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 jq 0:1.8.2-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 jq-devel 0:1.8.2-0.1.hum1

Vulnerabilities 10

  • High 7.1
    CVE-2026-49839

    jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow

    jq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds. When jv_load_file(raw=1) reads an attacker-controlled file…

    jqlang jq jq jq Debian Ubuntu Azure Linux Alpine
  • Medium 6.9
    CVE-2026-54679

    jq: potential integer overflow in jvp_string_append

    jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvp_string_append has a chance of integer/multiple overflowing and then causing a massive buffer overrun. This vulnerability is fixed in 1.8.2.

    jqlang jq jq jq Debian Ubuntu Alpine
  • Medium 6.8
    CVE-2026-47770

    jq: stack overflow in deep structural equality

    jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion (uncontrolled recursion).…

    jqlang jq jq jq Debian Ubuntu Azure Linux Alpine
  • Medium 6.4
    CVE-2026-41257

    jq: Signed-int overflow in `stack_reallocate` (jq VM stack)

    jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value…

    jqlang jq jq jq Debian Ubuntu Azure Linux Alpine
  • Medium 6.2
    CVE-2026-43894

    jq: Wild stack write via signed-integer overflow in decNumber D2U() macro

    jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The wrapped negative value bypasses the heap-allocation siz…

    jqlang jq jq jq Debian Ubuntu Azure Linux Alpine
  • Medium 6.2
    CVE-2026-43896

    jq: Stack Overflow in Recursive Object Merge

    jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects.

    jqlang jq jq jq Debian Ubuntu Azure Linux Alpine
  • Medium 5.5
    CVE-2026-41256

    jq: Embedded NUL truncates top-level jq programs loaded with -f

    jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \x00 and arbitrary suffix compiles a…

    jqlang jq jq jq Debian Ubuntu Azure Linux Alpine
  • Medium 5.4
    CVE-2026-40612

    jq: Stack overflow via unbounded recursion in jv_contains

    jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since the JSON parser caps at depth 10000), the C s…

    jqlang jq jq jq Debian Ubuntu Azure Linux Alpine
  • Medium 5.4
    CVE-2026-44777

    jq: stack overflow in module loading on mutual `include`

    jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two otherwise valid modules include each other.

    jqlang jq jq jq Debian Ubuntu Azure Linux Alpine
  • Medium 4.4
    CVE-2026-43895

    jq: Embedded NUL in jq import paths causes local redaction-policy bypass and preserves sensitive fields in published artifacts

    jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between t…

    jqlang jq jq jq Debian Ubuntu Azure Linux Alpine

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-43895
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-41256
  • report
    https://access.redhat.com/security/cve/CVE-2026-41257
  • report
    https://access.redhat.com/security/cve/CVE-2026-43896
  • report
    https://access.redhat.com/security/cve/CVE-2026-40612
  • report
    https://access.redhat.com/security/cve/CVE-2026-47770
  • report
    https://access.redhat.com/security/cve/CVE-2026-54679
  • report
    https://access.redhat.com/security/cve/CVE-2026-43894
  • report
    https://access.redhat.com/security/cve/CVE-2026-49839
  • report
    https://access.redhat.com/security/cve/CVE-2026-44777
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_29986.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2469183
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-40612
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-40612
  • article
    https://github.com/jqlang/jq/security/advisories/GHSA-r7m6-x9c7-h69j
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2469193
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-41256
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-41256
  • article
    https://github.com/jqlang/jq/security/advisories/GHSA-vf2h-chrj-q3fg
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2469187
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-41257
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-41257
  • article
    https://github.com/jqlang/jq/security/advisories/GHSA-4jm8-m363-4539
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2469175
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43894
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43894
  • article
    https://github.com/jqlang/jq/security/advisories/GHSA-5v7p-2r57-2g4g
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2469199
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43895
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43895
  • article
    https://github.com/jqlang/jq/security/advisories/GHSA-7q7g-mrq3-phxr
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2469184
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43896
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43896
  • article
    https://github.com/jqlang/jq/security/advisories/GHSA-mg96-6h3q-g846
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2469192
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-44777