Skip to main content

jq libjq CVE-2026-39979

| EUVDEUVD-2026-22128 MEDIUM
Out-of-bounds Read (CWE-125)
2026-04-13 GitHub_M
Buffer Overflow Information Disclosure Jq Jqlang
6.9
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Network-reachable via embedding in services, no auth required; C:L for partial memory disclosure, A:L for potential crash, I:N as no data modification is possible.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Red Hat
8.2 HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

6
Source Code Evidence Fetched
Jul 24, 2026 - 07:48 vuln.today
Analysis Generated
Jul 24, 2026 - 07:48 vuln.today
Patch released
Apr 23, 2026 - 16:50 nvd
Patch available
Patch available
Apr 16, 2026 - 05:29 EUVD
2f09060afab23fe9390cce7cb860b10416e1bf5f
EUVD ID Assigned
Apr 13, 2026 - 22:45 euvd
EUVD-2026-22128
CVE Published
Apr 13, 2026 - 22:18 nvd
MEDIUM 6.9

DescriptionCVE.org

jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.

AnalysisAI

Out-of-bounds read in libjq's jv_parse_sized() API exposes any embedding application to memory disclosure or process termination when processing malformed JSON in non-NUL-terminated buffers. All jq releases before commit 2f09060afab23fe9390cce7cb860b10416e1bf5f are affected per CPE cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*. SSVC marks the flaw as automatable with a POC noted, though EPSS sits at only 0.04% and CISA KEV has not listed it, indicating no confirmed widespread exploitation at time of analysis.

Technical ContextAI

The root cause (CWE-125, Out-of-bounds Read) is a format-string mismatch in src/jv_parse.c. The public API jv_parse_sized() accepts a counted buffer with an explicit integer length parameter, designed for callers who cannot guarantee NUL-termination. However, its error-handling branch passed the raw pointer to jv_string_fmt() using the %s specifier, which reads until it encounters a NUL byte regardless of the provided length. When a caller supplies a buffer that is exactly length bytes long with no trailing NUL - a legitimate use of the sized API - and the JSON is malformed, the error-construction code walks past the buffer boundary. The one-line fix in commit 2f09060 changes the format specifier from %s to %.*s and supplies the length argument, bounding the read to the declared buffer size. The flaw is exploitable through any libjq consumer that feeds untrusted, non-NUL-terminated data to jv_parse_sized(), which includes network-facing services that embed libjq for JSON validation or transformation.

RemediationAI

The primary fix is upgrading to the patched jq build containing commit 2f09060afab23fe9390cce7cb860b10416e1bf5f (https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f). Red Hat users should apply the applicable RHSA errata for their RHEL version (RHSA-2026:16252 through RHSA-2026:18048). Ubuntu users should apply USN-8202-1 via standard package updates. No exact tagged release version is independently confirmed in the input data - the fix is currently identified only by commit hash, so downstream distribution packages (RHEL, Ubuntu) are the most reliable upgrade path for production systems. As a short-term compensating control, applications using libjq directly can ensure all buffers passed to jv_parse_sized() are NUL-terminated, which prevents the out-of-bounds read at the call site without patching the library; the trade-off is that this requires application-level code changes and auditing all libjq call sites. Restricting untrusted JSON input at an API gateway or WAF layer reduces exposure surface for network-facing services but does not eliminate the vulnerability.

More in Jq

View all
CVE-2024-53427 HIGH POC
8.1 Feb 26

decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which ha
CVE-2015-8863 CRITICAL
9.8 May 06

Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (cras
CVE-2025-48060 HIGH POC
7.7 May 21

jq is a command-line JSON processor. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no auth
CVE-2016-4074 HIGH POC
7.5 May 06

The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and applicat
CVE-2023-49355 HIGH POC
7.5 Dec 11

decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" inpu
CVE-2023-50268 MEDIUM POC
5.5 Dec 13

jq is a command-line JSON processor. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Publ
CVE-2023-50246 MEDIUM POC
5.5 Dec 13

jq is a command-line JSON processor. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Publ
CVE-2026-32316 HIGH
8.2 Apr 13

Heap buffer overflow in jq command-line JSON processor (all versions through 1.8.1) allows remote unauthenticated attack
CVE-2026-49839 HIGH
7.1

Out-of-bounds write in the jq command-line JSON processor (CWE-787) lets a crafted JSON input corrupt memory when parsed
CVE-2026-54679 MEDIUM
6.9

jq, the command-line JSON processor, was patched in Alpine Linux with package version 1.8.2-r0. The specific vulnerabili
CVE-2026-47770 MEDIUM
6.8

jq on Alpine Linux was patched in package version 1.8.2-r0, addressing an unspecified vulnerability. The nature of the f
CVE-2026-41257 MEDIUM
6.4 May 11

Integer overflow in jq's bytecode VM data stack allocation tracking allows local attackers to corrupt heap memory and ac

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed
SLES15-SP6-CHOST-BYOS-Azure Fixed
SLES15-SP6-CHOST-BYOS-EC2 Fixed

Share

CVE-2026-39979 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy