CLSA-2026-1779273835

Import Source

https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1779273835.json

JSON Data

https://api.osv.dev/v1/vulns/CLSA-2026-1779273835

Upstream

CVE-2026-40164

CVE-2026-40612

CVE-2026-41256

CVE-2026-41257

CVE-2026-43894

CVE-2026-43895

CVE-2026-43896

CVE-2026-44777

Published

2026-05-20T10:44:00Z

Modified

2026-06-01T00:32:52.621927574Z

Summary

jq: Fix of 8 CVEs

Details

CVE-2026-40164: randomize hash seed to mitigate hash collision DoS
CVE-2026-40612: limit containment check depth
CVE-2026-41256: fix NUL truncation in program files loaded with -f
CVE-2026-41257: fix signed-int overflow in stack_reallocate
CVE-2026-43894: cap numeric literal length to DECMAXDIGITS
CVE-2026-43895: reject embedded NUL bytes in module import paths
CVE-2026-43896: limit recursive object merge depth
CVE-2026-44777: detect circular module imports

References

https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1779273835.html

Affected packages

TuxCare:AlmaLinux:9.6 / jq

Package

Name: jq
Purl: pkg:rpm/tuxcare/jq?distro=almalinux-9.6

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6-17.el9_6.2.tuxcare.els3

Database specific

source

"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1779273835.json"

TuxCare:AlmaLinux:9.6 / jq-devel

Package

Name: jq-devel
Purl: pkg:rpm/tuxcare/jq-devel?distro=almalinux-9.6

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6-17.el9_6.2.tuxcare.els3

Database specific

source

"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1779273835.json"