[BUG] CVE-2025-48060 fix available

[truthsword]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

jq v.7.1 > 1.8.0

Expected Behavior

jq v1.8.0

Steps To Reproduce

Scan latest image

Environment

NA

CPU architecture

x86-64

Docker creation

docker compose up

Container logs

![](https://i.imgur.com/IrDbZyD.png)

[Roxedus]

Thanks for the report.

Take a read here https://www.linuxserver.io/blog/image-vulnerability-scanning-and-you

Once there is a new OS package ready, our image will be updated.

[thespad]

https://github.com/linuxserver/docker-calibre/blob/master/package_versions.txt#L632C1-L632C126

jq                                                                            1.7.1-3ubuntu0.24.04.1                 deb     

jq (1.7.1-3ubuntu0.24.04.1) noble-security; urgency=medium

  * SECURITY UPDATE: integer overflow via signed integer limit
    - debian/patches/CVE-2024-23337.patch: fix signed integer overflow in
      jvp_array_write and jvp_object_rehash in src/jv.c, src/jv_aux.c,
      tests/jq.test.
    - CVE-2024-23337
  * SECURITY UPDATE: OOB write via NaN
    - debian/patches/CVE-2024-53427-1.patch: jv_number_value should cache
      the double value of literal numbers in jv.c.
    - debian/patches/CVE-2024-53427-2.patch: reject NaN with payload while
      parsing JSON in src/jv.c, tests/jq.test, tests/shtest.
    - CVE-2024-53427
  * SECURITY UPDATE: heap buffer overflow
    - debian/patches/CVE-2025-48060-1.patch: improve performance of
      repeating strings in src/builtin.c, src/jv.c, src/jv.h,
      tests/jq.test.
    - debian/patches/CVE-2025-48060-2.patch: fix heap buffer overflow when
      formatting an empty string in src/jv.c, tests/jq.test.
    - CVE-2025-48060

[thespad]

Oh, and

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 16 Jul 2025 09:48:44 -0400