Skip to main content

jq CVE-2026-39956

| EUVDEUVD-2026-22126 MEDIUM
Out-of-bounds Read (CWE-125)
2026-04-13 GitHub_M
Buffer Overflow Information Disclosure Jq Jqlang
6.1
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
6.1 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
vuln.today AI
6.1 MEDIUM

Attacker must control filter execution context (AV:L, UI:R); no prior privileges on jq required (PR:N); impact is limited memory read (C:L) and reliable crash (A:H) with no write path (I:N).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
6.1 MEDIUM
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High

Lifecycle Timeline

5
Source Code Evidence Fetched
Jul 24, 2026 - 07:49 vuln.today
Analysis Generated
Jul 24, 2026 - 07:49 vuln.today
Patch released
Apr 19, 2026 - 08:30 nvd
Patch available
EUVD ID Assigned
Apr 13, 2026 - 22:30 euvd
EUVD-2026-22126
CVE Published
Apr 13, 2026 - 22:10 nvd
MEDIUM 6.1

DescriptionCVE.org

jq is a command-line JSON processor. In commits after 69785bf77f86e2ea1b4a20ca86775916889e91c9, the _strindices builtin in jq's src/builtin.c passes its arguments directly to jv_string_indexes() without verifying they are strings, and jv_string_indexes() in src/jv.c relies solely on assert() checks that are stripped in release builds compiled with -DNDEBUG. This allows an attacker to crash jq trivially with input like _strindices(0), and by crafting a numeric value whose IEEE-754 bit pattern maps to a chosen pointer, achieve a controlled pointer dereference and limited memory read/probe primitive. Any deployment that evaluates untrusted jq filters against a release build is vulnerable. This issue has been patched in commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03.

AnalysisAI

Out-of-bounds read in jq release builds allows an attacker who controls filter input to crash the processor or probe process memory by passing a non-string argument to the _strindices builtin. Release builds compiled with -DNDEBUG strip the assert() type guards in jv_string_indexes(), enabling a type confusion that escalates from trivial denial-of-service to a controlled pointer dereference and limited memory read primitive via IEEE-754 bit-pattern manipulation. Publicly available exploit code exists per SSVC; EPSS remains at 0.01% (2nd percentile), indicating no widespread exploitation, and the attack is not in CISA KEV.

Technical ContextAI

jq (CPE: cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*) is a widely-used command-line JSON processor. The vulnerability resides in src/builtin.c, where the _strindices builtin forwards both of its arguments to jv_string_indexes() in src/jv.c without first validating that each is of JV_KIND_STRING type. In debug builds, assert() statements catch this mismatch at runtime, but standard release builds compiled with -DNDEBUG disable those assertions entirely, leaving the function operating on unvalidated type data. The root cause is CWE-125 (Out-of-Bounds Read): by supplying a double-precision floating-point value whose IEEE-754 bit pattern coincidentally maps to an arbitrary pointer value, an attacker can cause jq to dereference that pointer and read memory outside the intended buffer. The commit diff confirms the fix is a simple JV_KIND_STRING guard (jv_get_kind checks) that returns a proper type_error rather than proceeding with unsafe pointer arithmetic. The absence of this guard exclusively in release builds is what makes this a silent regression rather than an obvious crash in testing.

RemediationAI

The upstream fix is available in commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03 at https://github.com/jqlang/jq/commit/fdf8ef0f0810e3d365cdd5160de43db46f57ed03; a formally tagged release version is not independently confirmed from the available data, so organizations should build from the patched commit or await a distribution-packaged update. Ubuntu users should apply the fix via USN-8202-1 (https://ubuntu.com/security/notices/USN-8202-1). As a compensating control where patching is not immediately possible, deployments that evaluate untrusted jq filter expressions should validate or sanitize filter input to reject or escape calls to _strindices with non-string arguments before passing them to jq - this is effective but adds filter-parsing logic that itself must be maintained. The most impactful mitigation with no functional trade-off for data-processing pipelines is to restrict which inputs can supply filter expressions versus JSON data, ensuring users control only input data and not the filter string itself; this eliminates the exploitation surface entirely.

More in Jq

View all
CVE-2024-53427 HIGH POC
8.1 Feb 26

decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which ha
CVE-2015-8863 CRITICAL
9.8 May 06

Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (cras
CVE-2025-48060 HIGH POC
7.7 May 21

jq is a command-line JSON processor. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no auth
CVE-2016-4074 HIGH POC
7.5 May 06

The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and applicat
CVE-2023-49355 HIGH POC
7.5 Dec 11

decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" inpu
CVE-2023-50268 MEDIUM POC
5.5 Dec 13

jq is a command-line JSON processor. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Publ
CVE-2023-50246 MEDIUM POC
5.5 Dec 13

jq is a command-line JSON processor. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Publ
CVE-2026-32316 HIGH
8.2 Apr 13

Heap buffer overflow in jq command-line JSON processor (all versions through 1.8.1) allows remote unauthenticated attack
CVE-2026-49839 HIGH
7.1

Out-of-bounds write in the jq command-line JSON processor (CWE-787) lets a crafted JSON input corrupt memory when parsed
CVE-2026-54679 MEDIUM
6.9

jq, the command-line JSON processor, was patched in Alpine Linux with package version 1.8.2-r0. The specific vulnerabili
CVE-2026-39979 MEDIUM
6.9 Apr 13

Out-of-bounds read in libjq's jv_parse_sized() API exposes any embedding application to memory disclosure or process ter
CVE-2026-47770 MEDIUM
6.8

jq on Alpine Linux was patched in package version 1.8.2-r0, addressing an unspecified vulnerability. The nature of the f

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed
SLES15-SP6-CHOST-BYOS-Azure Fixed
SLES15-SP6-CHOST-BYOS-EC2 Fixed

Share

CVE-2026-39956 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy