MGASA-2026-0535

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2026-0535.html
Import Source
https://advisories.mageia.org/MGASA-2026-0535.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2026-0535
Upstream
CVE (9)
Published
2026-10-23T05:45:46Z
Modified
2026-10-23T06:01:08Z
Summary
Updated jq package fixes security vulnerabilities
Details

Embedded NUL truncates top-level jq programs loaded with -f. (CVE-2026-41256) Signed-int overflow in stack_reallocate (jq VM stack). (CVE-2026-41257) Wild stack write via signed-integer overflow in decNumber D2U() macro. (CVE-2026-43894) Embedded NUL in jq import paths causes local redaction-policy bypass and preserves sensitive fields in published artifacts. (CVE-2026-43895) Stack Overflow in Recursive Object Merge. (CVE-2026-43896) Stack overflow in module loading on mutual include. (CVE-2026-44777) Stack overflow in deep structural equality. (CVE-2026-47770) jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow. (CVE-2026-49839) Potential integer overflow in jvp_string_append. (CVE-2026-54679)

References
Credits

Affected packages

Mageia:10 / jq

Package

Name
jq
Purl
pkg:rpm/mageia/jq?arch=source&distro=mageia-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.8.2-1.mga10

Ecosystem specific 

{
    "section":  "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2026-0535.json"