Package: jq Version: 1.7.1-6+deb13u3 Severity: important X-Debbugs-Cc: [email protected], [email protected]
The upstream fix for CVE-2026-44777 [1] causes a severe regression in `jq`'s handling of transitive `include` instructions. [1]: https://github.com/jqlang/jq/commit/f58787c41835d9b17795730cb04925fdba25c71c $ cat foo.jq include "bar"; def foo: bar; $ cat bar.jq include "baz"; def bar: baz; $ cat baz.jq def baz: "baz"; $ jq -n 'include "foo"; foo' jq: src/compile.c:1179: expand_call_arglist: Assertion `0 && "Unknown function type"' failed. Aborted There is an upstream issue at [2] and an upstream PR at [3] (neither resolved yet). [2]: https://github.com/jqlang/jq/issues/3597 [3]: https://github.com/jqlang/jq/pull/3570 Previously this only affected 1.8.2 upstream, but with the recent security backports, this now affects Stable's 1.7.1 too. -- System Information: Debian Release: 13.6 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 6.12.101+deb13-amd64 (SMP w/16 CPU threads; PREEMPT) Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_WARN, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages jq depends on: ii libc6 2.41-12+deb13u3 ii libjq1 1.7.1-6+deb13u3 jq recommends no packages. jq suggests no packages. -- no debconf information
