{
	"document":{
		"aggregate_severity":{
			"namespace":"https://nvd.nist.gov/vuln-metrics/cvss",
			"text":"Medium"
		},
		"category":"csaf_vex",
		"csaf_version":"2.0",
		"distribution":{
			"tlp":{
				"label":"WHITE",
				"url":"https:/www.first.org/tlp/"
			}
		},
		"lang":"en",
		"notes":[
			{
				"text":"jq security update",
				"category":"general",
				"title":"Synopsis"
			},
			{
				"text":"An update for jq is now available for openEuler-22.03-LTS-SP4",
				"category":"general",
				"title":"Summary"
			},
			{
				"text":"jq is a lightweight and flexible command-line JSON processor. you can use it to slice and filter and map and transform structured data. It is written in portable C, and it has zero runtime dependencies. it can mangle the data format that you have into the one that you want.\n\nSecurity Fix(es):\n\njq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since the JSON parser caps at depth 10000), the C stack is exhausted.(CVE-2026-40612)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \\x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.(CVE-2026-41256)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.(CVE-2026-41257)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack buffer, and then writes ≈715 million 16-bit units (≈1.4 GiB) at an offset 1.43 GiB below the stack frame. The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).(CVE-2026-43894)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens.(CVE-2026-43895)\n\njq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects.(CVE-2026-43896)\n\njq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two\notherwise valid modules include each other.(CVE-2026-44777)",
				"category":"general",
				"title":"Description"
			},
			{
				"text":"An update for jq is now available for openEuler-22.03-LTS-SP4.\n\nopenEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.",
				"category":"general",
				"title":"Topic"
			},
			{
				"text":"Medium",
				"category":"general",
				"title":"Severity"
			},
			{
				"text":"jq",
				"category":"general",
				"title":"Affected Component"
			}
		],
		"publisher":{
			"issuing_authority":"openEuler security committee",
			"name":"openEuler",
			"namespace":"https://www.openeuler.org",
			"contact_details":"openeuler-security@openeuler.org",
			"category":"vendor"
		},
		"references":[
			{
				"summary":"openEuler-SA-2026-2425",
				"category":"self",
				"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2425"
			},
			{
				"summary":"CVE-2026-40612",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-40612&packageName=jq"
			},
			{
				"summary":"CVE-2026-41256",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-41256&packageName=jq"
			},
			{
				"summary":"CVE-2026-41257",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-41257&packageName=jq"
			},
			{
				"summary":"CVE-2026-43894",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-43894&packageName=jq"
			},
			{
				"summary":"CVE-2026-43895",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-43895&packageName=jq"
			},
			{
				"summary":"CVE-2026-43896",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-43896&packageName=jq"
			},
			{
				"summary":"CVE-2026-44777",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-44777&packageName=jq"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40612"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41256"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41257"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43894"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43895"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43896"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44777"
			},
			{
				"summary":"openEuler-SA-2026-2425 vex file",
				"category":"self",
				"url":"https://repo.openeuler.org/security/data/csaf/advisories/2026/csaf-openeuler-sa-2026-2425.json"
			}
		],
		"title":"An update for jq is now available for openEuler-22.03-LTS-SP4",
		"tracking":{
			"initial_release_date":"2026-05-22T21:22:08+08:00",
			"revision_history":[
				{
					"date":"2026-05-22T21:22:08+08:00",
					"summary":"Initial",
					"number":"1.0.0"
				}
			],
			"generator":{
				"date":"2026-05-22T21:22:08+08:00",
				"engine":{
					"name":"openEuler CSAF Tool V1.0"
				}
			},
			"current_release_date":"2026-05-22T21:22:08+08:00",
			"id":"openEuler-SA-2026-2425",
			"version":"1.0.0",
			"status":"final"
		}
	},
	"product_tree":{
		"branches":[
			{
				"name":"openEuler",
				"category":"vendor",
				"branches":[
					{
						"name":"openEuler",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4"
									},
									"product_id":"openEuler-22.03-LTS-SP4",
									"name":"openEuler-22.03-LTS-SP4"
								},
								"name":"openEuler-22.03-LTS-SP4",
								"category":"product_version"
							}
						],
						"category":"product_name"
					},
					{
						"name":"src",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4"
									},
									"product_id":"jq-1.8.0-4.oe2203sp4.src.rpm",
									"name":"jq-1.8.0-4.oe2203sp4.src.rpm"
								},
								"name":"jq-1.8.0-4.oe2203sp4.src.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					},
					{
						"name":"x86_64",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4"
									},
									"product_id":"jq-1.8.0-4.oe2203sp4.x86_64.rpm",
									"name":"jq-1.8.0-4.oe2203sp4.x86_64.rpm"
								},
								"name":"jq-1.8.0-4.oe2203sp4.x86_64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4"
									},
									"product_id":"jq-debuginfo-1.8.0-4.oe2203sp4.x86_64.rpm",
									"name":"jq-debuginfo-1.8.0-4.oe2203sp4.x86_64.rpm"
								},
								"name":"jq-debuginfo-1.8.0-4.oe2203sp4.x86_64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4"
									},
									"product_id":"jq-debugsource-1.8.0-4.oe2203sp4.x86_64.rpm",
									"name":"jq-debugsource-1.8.0-4.oe2203sp4.x86_64.rpm"
								},
								"name":"jq-debugsource-1.8.0-4.oe2203sp4.x86_64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4"
									},
									"product_id":"jq-devel-1.8.0-4.oe2203sp4.x86_64.rpm",
									"name":"jq-devel-1.8.0-4.oe2203sp4.x86_64.rpm"
								},
								"name":"jq-devel-1.8.0-4.oe2203sp4.x86_64.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					},
					{
						"name":"noarch",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4"
									},
									"product_id":"jq-help-1.8.0-4.oe2203sp4.noarch.rpm",
									"name":"jq-help-1.8.0-4.oe2203sp4.noarch.rpm"
								},
								"name":"jq-help-1.8.0-4.oe2203sp4.noarch.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					},
					{
						"name":"aarch64",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4"
									},
									"product_id":"jq-1.8.0-4.oe2203sp4.aarch64.rpm",
									"name":"jq-1.8.0-4.oe2203sp4.aarch64.rpm"
								},
								"name":"jq-1.8.0-4.oe2203sp4.aarch64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4"
									},
									"product_id":"jq-debuginfo-1.8.0-4.oe2203sp4.aarch64.rpm",
									"name":"jq-debuginfo-1.8.0-4.oe2203sp4.aarch64.rpm"
								},
								"name":"jq-debuginfo-1.8.0-4.oe2203sp4.aarch64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4"
									},
									"product_id":"jq-debugsource-1.8.0-4.oe2203sp4.aarch64.rpm",
									"name":"jq-debugsource-1.8.0-4.oe2203sp4.aarch64.rpm"
								},
								"name":"jq-debugsource-1.8.0-4.oe2203sp4.aarch64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4"
									},
									"product_id":"jq-devel-1.8.0-4.oe2203sp4.aarch64.rpm",
									"name":"jq-devel-1.8.0-4.oe2203sp4.aarch64.rpm"
								},
								"name":"jq-devel-1.8.0-4.oe2203sp4.aarch64.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					}
				]
			}
		],
		"relationships":[
			{
				"relates_to_product_reference":"openEuler-22.03-LTS-SP4",
				"product_reference":"jq-1.8.0-4.oe2203sp4.src.rpm",
				"full_product_name":{
					"product_id":"openEuler-22.03-LTS-SP4:jq-1.8.0-4.oe2203sp4.src",
					"name":"jq-1.8.0-4.oe2203sp4.src as a component of openEuler-22.03-LTS-SP4"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-22.03-LTS-SP4",
				"product_reference":"jq-1.8.0-4.oe2203sp4.x86_64.rpm",
				"full_product_name":{
					"product_id":"openEuler-22.03-LTS-SP4:jq-1.8.0-4.oe2203sp4.x86_64",
					"name":"jq-1.8.0-4.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-22.03-LTS-SP4",
				"product_reference":"jq-debuginfo-1.8.0-4.oe2203sp4.x86_64.rpm",
				"full_product_name":{
					"product_id":"openEuler-22.03-LTS-SP4:jq-debuginfo-1.8.0-4.oe2203sp4.x86_64",
					"name":"jq-debuginfo-1.8.0-4.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-22.03-LTS-SP4",
				"product_reference":"jq-debugsource-1.8.0-4.oe2203sp4.x86_64.rpm",
				"full_product_name":{
					"product_id":"openEuler-22.03-LTS-SP4:jq-debugsource-1.8.0-4.oe2203sp4.x86_64",
					"name":"jq-debugsource-1.8.0-4.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-22.03-LTS-SP4",
				"product_reference":"jq-devel-1.8.0-4.oe2203sp4.x86_64.rpm",
				"full_product_name":{
					"product_id":"openEuler-22.03-LTS-SP4:jq-devel-1.8.0-4.oe2203sp4.x86_64",
					"name":"jq-devel-1.8.0-4.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-22.03-LTS-SP4",
				"product_reference":"jq-help-1.8.0-4.oe2203sp4.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-22.03-LTS-SP4:jq-help-1.8.0-4.oe2203sp4.noarch",
					"name":"jq-help-1.8.0-4.oe2203sp4.noarch as a component of openEuler-22.03-LTS-SP4"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-22.03-LTS-SP4",
				"product_reference":"jq-1.8.0-4.oe2203sp4.aarch64.rpm",
				"full_product_name":{
					"product_id":"openEuler-22.03-LTS-SP4:jq-1.8.0-4.oe2203sp4.aarch64",
					"name":"jq-1.8.0-4.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-22.03-LTS-SP4",
				"product_reference":"jq-debuginfo-1.8.0-4.oe2203sp4.aarch64.rpm",
				"full_product_name":{
					"product_id":"openEuler-22.03-LTS-SP4:jq-debuginfo-1.8.0-4.oe2203sp4.aarch64",
					"name":"jq-debuginfo-1.8.0-4.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-22.03-LTS-SP4",
				"product_reference":"jq-debugsource-1.8.0-4.oe2203sp4.aarch64.rpm",
				"full_product_name":{
					"product_id":"openEuler-22.03-LTS-SP4:jq-debugsource-1.8.0-4.oe2203sp4.aarch64",
					"name":"jq-debugsource-1.8.0-4.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-22.03-LTS-SP4",
				"product_reference":"jq-devel-1.8.0-4.oe2203sp4.aarch64.rpm",
				"full_product_name":{
					"product_id":"openEuler-22.03-LTS-SP4:jq-devel-1.8.0-4.oe2203sp4.aarch64",
					"name":"jq-devel-1.8.0-4.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4"
				},
				"category":"default_component_of"
			}
		]
	},
	"vulnerabilities":[
		{
			"cve":"CVE-2026-40612",
			"notes":[
				{
					"text":"jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since the JSON parser caps at depth 10000), the C stack is exhausted.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":[
					"openEuler-22.03-LTS-SP4:jq-1.8.0-4.oe2203sp4.src",
					"openEuler-22.03-LTS-SP4:jq-1.8.0-4.oe2203sp4.x86_64",
					"openEuler-22.03-LTS-SP4:jq-debuginfo-1.8.0-4.oe2203sp4.x86_64",
					"openEuler-22.03-LTS-SP4:jq-debugsource-1.8.0-4.oe2203sp4.x86_64",
					"openEuler-22.03-LTS-SP4:jq-devel-1.8.0-4.oe2203sp4.x86_64",
					"openEuler-22.03-LTS-SP4:jq-help-1.8.0-4.oe2203sp4.noarch",
					"openEuler-22.03-LTS-SP4:jq-1.8.0-4.oe2203sp4.aarch64",
					"openEuler-22.03-LTS-SP4:jq-debuginfo-1.8.0-4.oe2203sp4.aarch64",
					"openEuler-22.03-LTS-SP4:jq-debugsource-1.8.0-4.oe2203sp4.aarch64",
					"openEuler-22.03-LTS-SP4:jq-devel-1.8.0-4.oe2203sp4.aarch64"
				]
			},
			"remediations":[
				{
					"product_ids":{"$ref":"$.vulnerabilities[0].product_status.fixed"},
					"details":"jq security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2425"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"MEDIUM",
						"baseScore":5.5,
						"vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
						"version":"3.1"
					},
					"products":{"$ref":"$.vulnerabilities[0].product_status.fixed"}
				}
			],
			"threats":[
				{
					"details":"Medium",
					"category":"impact"
				}
			],
			"title":"CVE-2026-40612"
		},
		{
			"cve":"CVE-2026-41256",
			"notes":[
				{
					"text":"jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \\x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":{"$ref":"$.vulnerabilities[0].product_status.fixed"}
			},
			"remediations":[
				{
					"product_ids":{"$ref":"$.vulnerabilities[0].product_status.fixed"},
					"details":"jq security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2425"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"MEDIUM",
						"baseScore":5.5,
						"vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
						"version":"3.1"
					},
					"products":{"$ref":"$.vulnerabilities[0].product_status.fixed"}
				}
			],
			"threats":[
				{
					"details":"Medium",
					"category":"impact"
				}
			],
			"title":"CVE-2026-41256"
		},
		{
			"cve":"CVE-2026-41257",
			"notes":[
				{
					"text":"jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":{"$ref":"$.vulnerabilities[0].product_status.fixed"}
			},
			"remediations":[
				{
					"product_ids":{"$ref":"$.vulnerabilities[0].product_status.fixed"},
					"details":"jq security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2425"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"MEDIUM",
						"baseScore":5.5,
						"vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
						"version":"3.1"
					},
					"products":{"$ref":"$.vulnerabilities[0].product_status.fixed"}
				}
			],
			"threats":[
				{
					"details":"Medium",
					"category":"impact"
				}
			],
			"title":"CVE-2026-41257"
		},
		{
			"cve":"CVE-2026-43894",
			"notes":[
				{
					"text":"jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack buffer, and then writes ≈715 million 16-bit units (≈1.4 GiB) at an offset 1.43 GiB below the stack frame. The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":{"$ref":"$.vulnerabilities[0].product_status.fixed"}
			},
			"remediations":[
				{
					"product_ids":{"$ref":"$.vulnerabilities[0].product_status.fixed"},
					"details":"jq security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2425"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"MEDIUM",
						"baseScore":5.5,
						"vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
						"version":"3.1"
					},
					"products":{"$ref":"$.vulnerabilities[0].product_status.fixed"}
				}
			],
			"threats":[
				{
					"details":"Medium",
					"category":"impact"
				}
			],
			"title":"CVE-2026-43894"
		},
		{
			"cve":"CVE-2026-43895",
			"notes":[
				{
					"text":"jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":{"$ref":"$.vulnerabilities[0].product_status.fixed"}
			},
			"remediations":[
				{
					"product_ids":{"$ref":"$.vulnerabilities[0].product_status.fixed"},
					"details":"jq security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2425"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"MEDIUM",
						"baseScore":4.4,
						"vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
						"version":"3.1"
					},
					"products":{"$ref":"$.vulnerabilities[0].product_status.fixed"}
				}
			],
			"threats":[
				{
					"details":"Medium",
					"category":"impact"
				}
			],
			"title":"CVE-2026-43895"
		},
		{
			"cve":"CVE-2026-43896",
			"notes":[
				{
					"text":"jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":{"$ref":"$.vulnerabilities[0].product_status.fixed"}
			},
			"remediations":[
				{
					"product_ids":{"$ref":"$.vulnerabilities[0].product_status.fixed"},
					"details":"jq security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2425"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"MEDIUM",
						"baseScore":5.5,
						"vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
						"version":"3.1"
					},
					"products":{"$ref":"$.vulnerabilities[0].product_status.fixed"}
				}
			],
			"threats":[
				{
					"details":"Medium",
					"category":"impact"
				}
			],
			"title":"CVE-2026-43896"
		},
		{
			"cve":"CVE-2026-44777",
			"notes":[
				{
					"text":"jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two\notherwise valid modules include each other.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":{"$ref":"$.vulnerabilities[0].product_status.fixed"}
			},
			"remediations":[
				{
					"product_ids":{"$ref":"$.vulnerabilities[0].product_status.fixed"},
					"details":"jq security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2425"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"MEDIUM",
						"baseScore":5.5,
						"vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
						"version":"3.1"
					},
					"products":{"$ref":"$.vulnerabilities[0].product_status.fixed"}
				}
			],
			"threats":[
				{
					"details":"Medium",
					"category":"impact"
				}
			],
			"title":"CVE-2026-44777"
		}
	]
}