Jq
CVE-2026-33948
LOW
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.
AnalysisAI
Input validation bypass in jq command-line JSON processor allows attackers to craft JSON with embedded NUL bytes that jq incorrectly truncates, validating only a benign prefix while silently discarding malicious trailing data. Versions before commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b are affected; the vulnerability enables parser differential attacks where jq validates hostile input as safe JSON, but downstream consumers process the complete input including injected payloads. With low CVSS (2.9) and attack timing complexity, exploitation risk remains moderate in scenarios where jq serves as a validation gate for untrusted JSON forwarded to other processors.
Technical ContextAI
jq implements JSON parsing by reading input via fgets() into a buffer, then calculating the string length using strlen(), which terminates at the first NUL byte (0x00 character). This causes a length mismatch: fgets() may fill the buffer with N bytes of actual data, but strlen() reports only the count before the first NUL, artificially truncating the logical input. The root cause is improper input length handling (CWE-20: Improper Input Validation) combined with a classic buffer handling error where length calculation ignores embedded NUL bytes. Attackers exploit this by supplying input structured as valid_json\x00malicious_data-jq parses and validates only the benign prefix, then discards the suffix without error, while a parser that respects the full octet stream (e.g., one reading from a file descriptor or memory without relying on strlen()) will process both parts. This is a parser differential vulnerability stemming from how C's str-based APIs (strlen) conflict with true binary-safe I/O semantics.
RemediationAI
Update jq to a version incorporating commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b or later. For Linux distributions, use your package manager (apt, yum, brew, etc.) to upgrade to the latest available jq release; most distributions have already patched this in recent versions. For users building from source, clone the jq repository and build from the main branch or any release tagged after the fix commit. Interim mitigation for systems unable to patch immediately: pre-filter untrusted JSON input using a binary-safe parser or octet-stream validator (e.g., a Python script using json.loads with proper byte handling) before passing to jq, thereby avoiding reliance on jq as a sole validation gate. Detailed patching guidance is available at https://github.com/jqlang/jq/security/advisories/GHSA-32cx-cvvh-2wj9.
decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which ha
Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (cras
jq is a command-line JSON processor. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no auth
The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and applicat
decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" inpu
jq is a command-line JSON processor. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Publ
jq is a command-line JSON processor. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Publ
Heap buffer overflow in jq command-line JSON processor (all versions through 1.8.1) allows remote unauthenticated attack
Out-of-bounds write in the jq command-line JSON processor (CWE-787) lets a crafted JSON input corrupt memory when parsed
jq, the command-line JSON processor, was patched in Alpine Linux with package version 1.8.2-r0. The specific vulnerabili
Out-of-bounds read in libjq's jv_parse_sized() API exposes any embedding application to memory disclosure or process ter
jq on Alpine Linux was patched in package version 1.8.2-r0, addressing an unspecified vulnerability. The nature of the f
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today