new file mode 100644
@@ -0,0 +1,50 @@
+From 8e7a4a3c01da36e0b9509b0e93a005649318e0f7 Mon Sep 17 00:00:00 2001
+From: tlsbollei <170938166+tlsbollei@users.noreply.github.com>
+Date: Wed, 8 Apr 2026 21:43:46 +0200
+Subject: [PATCH] Add runtime type checks to f_string_indexes
+
+This fixes CVE-2026-39956.
+---
+ src/builtin.c | 8 ++++++++
+ tests/jq.test | 9 +++++++++
+ 2 files changed, 17 insertions(+)
+
+diff --git a/src/builtin.c b/src/builtin.c
+index 52fe77c..ac56f9f 100644
+--- a/src/builtin.c
++++ b/src/builtin.c
+@@ -1286,6 +1286,14 @@ static jv f_string_explode(jq_state *jq, jv a) {
+ }
+
+ static jv f_string_indexes(jq_state *jq, jv a, jv b) {
++ if (jv_get_kind(a) != JV_KIND_STRING) {
++ jv_free(b);
++ return type_error(a, "cannot be searched, as it is not a string");
++ }
++ if (jv_get_kind(b) != JV_KIND_STRING) {
++ jv_free(a);
++ return type_error(b, "is not a string");
++ }
+ return jv_string_indexes(a, b);
+ }
+
+diff --git a/tests/jq.test b/tests/jq.test
+index 4ecf72f..07aa0cf 100644
+--- a/tests/jq.test
++++ b/tests/jq.test
+@@ -1520,6 +1520,15 @@ split("")
+ "xababababax"
+ [1,7,[1,3,5,7]]
+
++# _strindices is used by indices/1 but is callable
++try _strindices("abc") catch .
++123
++"number (123) cannot be searched, as it is not a string"
++
++try _strindices(123) catch .
++"abc"
++"number (123) is not a string"
++
+ # trim
+ # \u000b is vertical tab (\v not supported by json)
+ map(trim), map(ltrim), map(rtrim)
@@ -27,6 +27,7 @@ SRC_URI = "git://github.com/jqlang/jq.git;protocol=https;branch=master;tag=jq-${
file://CVE-2026-43895.patch \
file://CVE-2026-49839.patch \
file://CVE-2026-54679.patch \
+ file://CVE-2026-39956.patch \
"
inherit autotools ptest