{
  "document": {
    "aggregate_severity": {
      "text": "Medium"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/tuxcare9.8esu/vex/2026/cve-2026-43894-els_os-tuxcare9_8esu.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-09-28T17:11:43Z",
      "generator": {
        "date": "2026-09-28T17:11:43Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2026-43894-ELS_OS-TUXCARE9.8ESU",
      "initial_release_date": "2026-05-11T18:16:00Z",
      "revision_history": [
        {
          "date": "2026-05-11T18:16:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-28T17:11:43Z",
          "number": "2",
          "summary": "Official Publication"
        }
      ],
      "status": "final",
      "version": "2"
    },
    "title": "Security update on CVE-2026-43894"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "AlmaLinux 9.8",
                "product": {
                  "name": "AlmaLinux 9.8",
                  "product_id": "AlmaLinux-9.8",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:almalinux:almalinux:9.8:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "AlmaLinux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jq-0:1.6-19.el9_8.2.i686",
                "product": {
                  "name": "jq-0:1.6-19.el9_8.2.i686",
                  "product_id": "jq-0:1.6-19.el9_8.2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/almalinux/jq@1.6-19.el9_8.2?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jq-devel-0:1.6-19.el9_8.2.i686",
                "product": {
                  "name": "jq-devel-0:1.6-19.el9_8.2.i686",
                  "product_id": "jq-devel-0:1.6-19.el9_8.2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/almalinux/jq-devel@1.6-19.el9_8.2?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jq-0:1.6-19.el9_8.2.x86_64",
                "product": {
                  "name": "jq-0:1.6-19.el9_8.2.x86_64",
                  "product_id": "jq-0:1.6-19.el9_8.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/almalinux/jq@1.6-19.el9_8.2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jq-devel-0:1.6-19.el9_8.2.x86_64",
                "product": {
                  "name": "jq-devel-0:1.6-19.el9_8.2.x86_64",
                  "product_id": "jq-devel-0:1.6-19.el9_8.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/almalinux/jq-devel@1.6-19.el9_8.2?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jq-0:1.6-19.el9_8.2.aarch64",
                "product": {
                  "name": "jq-0:1.6-19.el9_8.2.aarch64",
                  "product_id": "jq-0:1.6-19.el9_8.2.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/almalinux/jq@1.6-19.el9_8.2?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jq-devel-0:1.6-19.el9_8.2.aarch64",
                "product": {
                  "name": "jq-devel-0:1.6-19.el9_8.2.aarch64",
                  "product_id": "jq-devel-0:1.6-19.el9_8.2.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/almalinux/jq-devel@1.6-19.el9_8.2?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          }
        ],
        "category": "vendor",
        "name": "AlmaLinux OS Foundation"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Rocky Linux 9.8",
                "product": {
                  "name": "Rocky Linux 9.8",
                  "product_id": "Rocky Linux-9.8",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:resf:rocky_linux:9.8:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Rocky Linux"
          }
        ],
        "category": "vendor",
        "name": "Rocky Linux"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jq-0:1.6-19.el9_8.2.tuxcare.els1.i686",
                "product": {
                  "name": "jq-0:1.6-19.el9_8.2.tuxcare.els1.i686",
                  "product_id": "jq-0:1.6-19.el9_8.2.tuxcare.els1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/jq@1.6-19.el9_8.2.tuxcare.els1?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686",
                "product": {
                  "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686",
                  "product_id": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/jq-devel@1.6-19.el9_8.2.tuxcare.els1?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64",
                "product": {
                  "name": "jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64",
                  "product_id": "jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/jq@1.6-19.el9_8.2.tuxcare.els1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64",
                "product": {
                  "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64",
                  "product_id": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/jq-devel@1.6-19.el9_8.2.tuxcare.els1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64",
                "product": {
                  "name": "jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64",
                  "product_id": "jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/jq@1.6-19.el9_8.2.tuxcare.els1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64",
                "product": {
                  "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64",
                  "product_id": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/jq-devel@1.6-19.el9_8.2.tuxcare.els1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jq-0:1.6-19.el9_8.2.tuxcare.els1.i686 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686"
        },
        "product_reference": "jq-0:1.6-19.el9_8.2.tuxcare.els1.i686",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jq-0:1.6-19.el9_8.2.i686 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.i686"
        },
        "product_reference": "jq-0:1.6-19.el9_8.2.i686",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64"
        },
        "product_reference": "jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jq-0:1.6-19.el9_8.2.x86_64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.x86_64"
        },
        "product_reference": "jq-0:1.6-19.el9_8.2.x86_64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64"
        },
        "product_reference": "jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jq-0:1.6-19.el9_8.2.aarch64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.aarch64"
        },
        "product_reference": "jq-0:1.6-19.el9_8.2.aarch64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64"
        },
        "product_reference": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jq-devel-0:1.6-19.el9_8.2.x86_64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.x86_64"
        },
        "product_reference": "jq-devel-0:1.6-19.el9_8.2.x86_64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686"
        },
        "product_reference": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jq-devel-0:1.6-19.el9_8.2.i686 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.i686"
        },
        "product_reference": "jq-devel-0:1.6-19.el9_8.2.i686",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64"
        },
        "product_reference": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jq-devel-0:1.6-19.el9_8.2.aarch64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.aarch64"
        },
        "product_reference": "jq-devel-0:1.6-19.el9_8.2.aarch64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jq-0:1.6-19.el9_8.2.tuxcare.els1.i686 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686"
        },
        "product_reference": "jq-0:1.6-19.el9_8.2.tuxcare.els1.i686",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jq-0:1.6-19.el9_8.2.i686 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.i686"
        },
        "product_reference": "jq-0:1.6-19.el9_8.2.i686",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64"
        },
        "product_reference": "jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jq-0:1.6-19.el9_8.2.x86_64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.x86_64"
        },
        "product_reference": "jq-0:1.6-19.el9_8.2.x86_64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64"
        },
        "product_reference": "jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jq-0:1.6-19.el9_8.2.aarch64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.aarch64"
        },
        "product_reference": "jq-0:1.6-19.el9_8.2.aarch64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64"
        },
        "product_reference": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jq-devel-0:1.6-19.el9_8.2.x86_64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.x86_64"
        },
        "product_reference": "jq-devel-0:1.6-19.el9_8.2.x86_64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686"
        },
        "product_reference": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jq-devel-0:1.6-19.el9_8.2.i686 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.i686"
        },
        "product_reference": "jq-devel-0:1.6-19.el9_8.2.i686",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64"
        },
        "product_reference": "jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jq-devel-0:1.6-19.el9_8.2.aarch64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.aarch64"
        },
        "product_reference": "jq-devel-0:1.6-19.el9_8.2.aarch64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-43894",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "description",
          "text": "jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack buffer, and then writes ≈715 million 16-bit units (≈1.4 GiB) at an offset 1.43 GiB below the stack frame. The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).",
          "title": "Vulnerability description"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.aarch64",
          "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.i686",
          "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64",
          "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686",
          "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64",
          "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.x86_64",
          "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.aarch64",
          "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.i686",
          "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64",
          "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686",
          "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64",
          "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.x86_64",
          "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.aarch64",
          "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.i686",
          "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64",
          "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686",
          "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64",
          "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.x86_64",
          "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.aarch64",
          "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.i686",
          "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64",
          "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686",
          "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64",
          "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-43894"
        },
        {
          "category": "external",
          "summary": "https://github.com/jqlang/jq/security/advisories/GHSA-5v7p-2r57-2g4g",
          "url": "https://github.com/jqlang/jq/security/advisories/GHSA-5v7p-2r57-2g4g"
        }
      ],
      "release_date": "2026-05-11T18:16:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "date": "2026-09-18T20:29:35.171945Z",
          "details": "This is a local-only flaw in the jq CLI that triggers only when jq is made to parse or construct an extreme number literal of roughly 2,147,483,646 digits—an artificial scenario that requires multi‑gigabyte memory and, in practice, results in a crash of the jq process (availability impact) rather than any demonstrated code execution. It is not reachable via normal JSON parsing paths, has no confidentiality or integrity impact, and jq is not a network‑exposed service, so in managed server/VM environments the practical risk is limited to a self‑DoS of a locally invoked utility and can be safely deprioritized.",
          "product_ids": [
            "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.aarch64",
            "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.i686",
            "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64",
            "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686",
            "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64",
            "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.x86_64",
            "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.aarch64",
            "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.i686",
            "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64",
            "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686",
            "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64",
            "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.x86_64",
            "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.aarch64",
            "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.i686",
            "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64",
            "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686",
            "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64",
            "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.x86_64",
            "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.aarch64",
            "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.i686",
            "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64",
            "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686",
            "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64",
            "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.aarch64",
            "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.i686",
            "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64",
            "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686",
            "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64",
            "AlmaLinux-9.8:jq-0:1.6-19.el9_8.2.x86_64",
            "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.aarch64",
            "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.i686",
            "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64",
            "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686",
            "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64",
            "AlmaLinux-9.8:jq-devel-0:1.6-19.el9_8.2.x86_64",
            "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.aarch64",
            "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.i686",
            "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.aarch64",
            "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.i686",
            "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.tuxcare.els1.x86_64",
            "Rocky Linux-9.8:jq-0:1.6-19.el9_8.2.x86_64",
            "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.aarch64",
            "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.i686",
            "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.aarch64",
            "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.i686",
            "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.tuxcare.els1.x86_64",
            "Rocky Linux-9.8:jq-devel-0:1.6-19.el9_8.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    }
  ]
}