Loading story…
The jq project disclosed and patched CVE-2026-33947, an unbounded-recursion flaw in jv_setpath(), jv_getpath(), and delpaths_sorted() in src/jv_aux.c that affects versions through 1.8.1. The bug can be triggered with attacker-controlled path arrays of roughly 60,000+ elements, causing stack exhaustion, SIGSEGV, and process termination. Maintainers said the issue bypasses jq's MAX_PARSING_DEPTH safeguard because the malicious path arrays can be built programmatically at runtime rather than during JSON parsing, creating a denial-of-service risk for web services, CI/CD pipelines, shell scripts, and applications embedding libjq that process untrusted input. The flaw was rated Moderate with CVSS 3.1/6.2 and mapped to CWE-674, and a fix was identified in commit fb59f1491058d58bdc3e8dd28f1773d1ac690a1f alongside a GitHub security advisory.
Separately, the ROOT project faced public disclosure of a reported heap buffer overflow in TKey::Streamer and TBasket::ReadBasketBuffers, with maintainers and oss-security moderators noting that the fix was already public in pull request #22377. The mailing-list exchange emphasized that oss-security is no longer the correct channel for requesting CVE assignments, and ROOT contributors directed reporters to the project's GitHub security reporting process for coordinated disclosure. The discussion also noted that the advisory had effectively become public once posted to the list, while participants raised concerns about disclosure quality and the appearance of AI-generated language in vulnerability reports.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
During the oss-security discussion, participants stated that a fix for the ROOT heap buffer overflow was already publicly available in pull request #22377. ROOT users were also directed to the project's GitHub security reporting channel for future vulnerability reports and coordinated disclosure.
A vulnerability affecting ROOT's TKey::Streamer and TBasket::ReadBasketBuffers was publicly discussed on the oss-security mailing list, effectively disclosing the issue. The thread noted that CVE assignment requests should no longer be made through oss-security and referenced an intended advisory timeline tied to CVE assignment or a 90-day disclosure period.
An oss-security mailing list post further discussed CVE-2026-33947, reiterating the denial-of-service impact and the availability of the fix commit. The thread also raised the question of whether stack overflows in command-line programs should routinely receive CVEs unless embedded-library use materially increases risk.
A GitHub security advisory disclosed CVE-2026-33947 in jq, describing how programmatically constructed path arrays can bypass MAX_PARSING_DEPTH and trigger unbounded recursion. The issue was rated Moderate with CVSS 6.2 and identified as a denial-of-service risk for services, scripts, CI/CD pipelines, and applications embedding libjq that process untrusted input.
The jq project addressed an unbounded recursion vulnerability affecting jv_setpath(), jv_getpath(), and delpaths_sorted() in src/jv_aux.c with commit fb59f1491058d58bdc3e8dd28f1773d1ac690a1f. The flaw affects jq versions up to and including 1.8.1 and can cause stack exhaustion and process termination when attacker-controlled path arrays contain roughly 60,000 or more elements.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities were disclosed in **PJSIP** affecting version `2.16` and earlier, exposing the widely used multimedia communication library to memory corruption risks. `CVE-2026-40614` is a **heap buffer overflow** in the Opus codec decode path, where insufficient validation of buffer sizes allows `codec_decode()` to copy more data than allocated after `codec_parse()` emits encoded frames larger than the FEC decode buffer calculation anticipates. The flaw is tied to unchecked `pj_memcpy()` operations and was classified as `CWE-122`, with high potential impact to confidentiality, integrity, and availability. A second issue, `CVE-2026-40892`, is a **stack buffer overflow** in `pjsip_auth_create_digest2()` when pre-computed digest credentials are supplied through `PJSIP_CRED_DATA_DIGEST`. In that path, credential data is copied using `cred_info->data.slen` without enforcing the expected digest-length limit, allowing overflow of the fixed 128-byte `ha1` stack buffer. The vulnerability was classified as `CWE-121`, and both CVEs were published with GitHub advisory references and fixing commits, indicating that maintainers have issued patches for affected deployments.
Jun 29, 2026
A high-severity denial-of-service vulnerability, **CVE-2026-67215**, has been disclosed in **DaveGamble cJSON** through version `1.7.19`. The flaw affects applications that process untrusted **RFC 6902 JSON Patch** input with `cJSONUtils_ApplyPatches()` or `cJSONUtils_ApplyPatchesCaseSensitive()`, where crafted `add` and `copy` operations can duplicate subtrees and drive document depth far beyond expected limits. The crash occurs because `cJSON_Delete()` can recurse without a depth bound, leading to stack exhaustion. Advisory details note that `CJSON_CIRCULAR_LIMIT` is set to `10000`, substantially higher than the parser's roughly `1000`-level nesting limit, creating a path for remote attackers with no privileges or user interaction to terminate affected processes. The issue is tracked as **CWE-674** and carries a **CVSS v3.1** score vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`, reflecting high availability impact.
Jul 29, 2026
Several **high-severity vulnerability disclosures** were published across widely used developer and infrastructure components, with impacts ranging from **remote code execution (RCE)** to **account takeover** and **arbitrary host file writes**. In *Gogs* (self-hosted Git service), three CVEs were reported: **CVE-2025-64111** (CVSS 9.3) enables RCE by bypassing checks in `UpdateRepoFile` to modify `.git/config` via the API (described as an insufficient fix for an earlier issue); **CVE-2025-64175** (CVSS 7.7) allows a **cross-account 2FA recovery-code bypass** in versions `0.13.3` and earlier if an attacker already has a victim’s username/password; and **CVE-2026-24135** (CVSS 7.2) is a wiki rename path traversal that can delete arbitrary files by manipulating `old_title`. Separately, *Jinjava* (HubSpot CMS template engine) disclosed **CVE-2026-25526** (CVSS 9.8), a sandbox escape chain that permits arbitrary Java code execution by abusing `ForTag` iteration behavior (Bean ELResolver restriction bypass) and `ObjectMapper`-based JSON deserialization to instantiate disallowed classes. A critical Kubernetes storage issue was also disclosed in *Kubernetes Local Path Provisioner*: **CVE-2025-62878** (CVSS 10.0) allows directory traversal via the `parameters.pathPattern` setting, enabling a user who can create storage resources to provision volumes in arbitrary host locations (e.g., `/etc`) and potentially overwrite sensitive files on cluster nodes. In parallel to these product flaws, separate research reported widespread **exposure of Git metadata** on the public internet—approximately **4.96 million** IPs with accessible `.git` directories and **250,000+** exposing `.git/config` files that may contain deployment credentials—highlighting a common, high-impact misconfiguration pattern that can enable source code reconstruction and secret theft. Active exploitation activity was reported for *Ivanti Endpoint Manager Mobile (EPMM)* involving **CVE-2026-1281** and **CVE-2026-1340**, where attackers were observed dropping `/mifs/403.jsp` and using a Base64-delivered Java class loader designed for delayed, in-memory activation rather than immediate interactive webshell use.
Jun 29, 2026