openSUSE-SU-2026:21500-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21500-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2026:21500-1
Upstream
CVE (2)
Related
CVE (2)
Published
2026-07-29T09:24:09Z
Modified
2026-07-31T18:24:09Z
Summary
Security update for yq
Details

This update for yq fixes the following issues:

Changes in yq:

  • Update the golang.org/x/net dependency to version v0.57.0 to fix CVE-2026-39821 for good (bsc#1267199).

  • update to v4.53.3 Add --ini-preserve-quotes flag for INI round-trip quote preservation. Fix: reset INI decoder state on init. Fix: decode properties array bracket paths. Fix: preserve floats with trailing zero when encoding YAML to JSON. Fix: JSON to TOML root scope and null handling. Fix: reset TOML decoder finished flag on Init for multi-doc evaluation. Fix: reset TOML decoder between files when evaluating all at once. Fix: preserve TOML inline table array scope. Fix: preserve empty TOML arrays in tables Fix: TOML encoder uses inline tables for YAML FlowStyle mappings. Fix nested inline YAML merge explode. Fix repeatString overflow test on 32-bit platforms.

  • Fix CVE-2026-56852 (GO-2026-5970) (bsc#1271994): A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

References

Affected packages

openSUSE:Leap 16.0 / yq

Package

Name
yq
Purl
pkg:rpm/opensuse/yq&distro=openSUSE%20Leap%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.53.3-bp160.1.1

Ecosystem specific 

{
    "binaries":  [
        {
            "yq":  "4.53.3-bp160.1.1",
            "yq-bash-completion":  "4.53.3-bp160.1.1",
            "yq-fish-completion":  "4.53.3-bp160.1.1",
            "yq-zsh-completion":  "4.53.3-bp160.1.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21500-1.json"