Skip to main content

Jq CVE-2026-32316

| EUVDEUVD-2026-22039 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-04-13 GitHub_M
Buffer Overflow Heap Overflow Jq Jqlang
8.2
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
SUSE
HIGH
qualitative
Red Hat
6.8 MEDIUM
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High

Lifecycle Timeline

6
Patch released
Apr 19, 2026 - 02:30 nvd
Patch available
Re-analysis Queued
Apr 17, 2026 - 15:52 vuln.today
cvss_changed
Analysis Generated
Apr 15, 2026 - 12:32 vuln.today
EUVD ID Assigned
Apr 13, 2026 - 18:00 euvd
EUVD-2026-22039
Analysis Generated
Apr 13, 2026 - 18:00 vuln.today
CVE Published
Apr 13, 2026 - 17:49 nvd
HIGH 8.2

DescriptionGitHub Advisory

jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5.

AnalysisAI

Heap buffer overflow in jq command-line JSON processor (all versions through 1.8.1) allows remote unauthenticated attackers to crash processes or potentially achieve code execution via crafted queries producing strings exceeding 2^31 bytes. Integer overflow in jvp_string_append() and jvp_string_copy_replace_bad() functions causes undersized buffer allocation followed by heap corruption. Publicly available exploit code exists (SSVC: POC). EPSS score of 0.04% (12th percentile) suggests low observe

Technical ContextAI

jq is a widely-deployed command-line JSON processor and embedded library (jqlang:jq) used for parsing, filtering, and transforming JSON data. The vulnerability stems from CWE-190 (Integer Overflow or Wraparound) in string concatenation logic within jvp_string_append() and jvp_string_copy_replace_bad() functions. When concatenating strings with combined length exceeding 2,147,483,648 bytes (2^31), the 32-bit unsigned integer calculation for heap buffer size wraps around, allocating a drastically smaller buffer than required. Subsequent memcpy or similar operations then write the full multi-gigabyte string data into this undersized buffer, causing CWE-122 (Heap-based Buffer Overflow). Unlike jq's array and object handling which enforce size limits, string operations lacked bounds checking prior to the fix. This architectural inconsistency created an exploitable primitive when processing maliciously crafted jq filter expressions that generate extremely large output strings through concatenation operations.

RemediationAI

Upstream fix available in commit e47e56d226519635768e6aab2f38f0ab037c09e5 which implements string size bounds checking aligned with existing array and object limits. Organizations should immediately upgrade to jq builds incorporating this commit or later. For deployments where immediate patching is infeasible, implement input validation to reject jq queries producing output strings approaching gigabyte scale, enforce query complexity limits, or isolate jq processing in sandboxed environments with memory limits (ulimit, cgroups, containers). Review and restrict which users or systems can submit arbitrary jq queries to minimize attack surface. Monitor for abnormal memory consumption patterns in jq processes as potential exploitation indicators. Consult vendor advisory at https://github.com/jqlang/jq/security/advisories/GHSA-q3h9-m34w-h76f and patch commit details at https://github.com/jqlang/jq/commit/e47e56d226519635768e6aab2f38f0ab037c09e5 for technical implementation guidance.

More in Jq

View all
CVE-2024-53427 HIGH POC
8.1 Feb 26

decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which ha
CVE-2015-8863 CRITICAL
9.8 May 06

Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (cras
CVE-2025-48060 HIGH POC
7.7 May 21

jq is a command-line JSON processor. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no auth
CVE-2016-4074 HIGH POC
7.5 May 06

The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and applicat
CVE-2023-49355 HIGH POC
7.5 Dec 11

decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" inpu
CVE-2023-50268 MEDIUM POC
5.5 Dec 13

jq is a command-line JSON processor. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Publ
CVE-2023-50246 MEDIUM POC
5.5 Dec 13

jq is a command-line JSON processor. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Publ
CVE-2026-49839 HIGH
7.1

Out-of-bounds write in the jq command-line JSON processor (CWE-787) lets a crafted JSON input corrupt memory when parsed
CVE-2026-54679 MEDIUM
6.9

jq, the command-line JSON processor, was patched in Alpine Linux with package version 1.8.2-r0. The specific vulnerabili
CVE-2026-39979 MEDIUM
6.9 Apr 13

Out-of-bounds read in libjq's jv_parse_sized() API exposes any embedding application to memory disclosure or process ter
CVE-2026-47770 MEDIUM
6.8

jq on Alpine Linux was patched in package version 1.8.2-r0, addressing an unspecified vulnerability. The nature of the f
CVE-2026-41257 MEDIUM
6.4 May 11

Integer overflow in jq's bytecode VM data stack allocation tracking allows local attackers to corrupt heap memory and ac

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed
SLES15-SP6-CHOST-BYOS-Azure Fixed
SLES15-SP6-CHOST-BYOS-EC2 Fixed

Share

CVE-2026-32316 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy