Bug 2469192 (CVE-2026-44777)
| Summary: | CVE-2026-44777 jq: stack overflow in module loading on mutual include | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | akhatavk, amctagga, aoconnor, aos-team-art-private, asdas, bniver, dpaolell, dschmidt, erezende, flucifre, gmeno, groman, jdelft, jlanda, jmitchel, jupierce, kshier, lgarciaa, mbenjamin, mbiarnes, mhackett, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, simaishi, smcdonal, sostapov, stcannon, suppawar, teagle, vereddy, vlaad, watson-tool-maintainers, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in jq, a command line JSON processor. The module loader fails to perform cycle detection when resolving imports. This missing cycle detection allows an attacker who can supply crafted modules with circular dependencies to exhaust the stack memory, causing an application crash, resulting in a denial of service.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2477236 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-05-11 18:02:50 UTC
|