EUVD-2026-39500Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Malicious input must reach a local jq run (AV:L, UI:R) with no privileges (PR:N); memory corruption gives I:H/A:H and no disclosure (C:N).
Primary rating from Vendor (vendor:alpine).
CVSS VectorVendor: vendor:alpine
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Alpine Linux: jq fixed in 1.8.2-r0
AnalysisAI
Out-of-bounds write in the jq command-line JSON processor (CWE-787) lets a crafted JSON input corrupt memory when parsed, threatening the integrity and availability of the processing host. Tracked upstream as GHSA-cfh2-vwfq-qfmm and packaged by Alpine Linux, the flaw requires a victim to run jq against attacker-controlled data (local vector, user interaction required). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim invoke jq (the CLI or library) on attacker-controlled JSON input; the CVSS UI:R confirms a user or automation action is needed to feed the malicious data to jq, and AV:L confirms the input must reach a local jq process rather than being triggered over the network directly. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H, base 7.1) describes a locally-triggered, low-complexity flaw needing no privileges but requiring user interaction, yielding high integrity and availability impact with no confidentiality loss - consistent with memory corruption (crash or possible data tampering) rather than disclosure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious JSON document and gets it delivered to a system where jq will process it - for example, a webhook payload or API response consumed by a CI script that runs jq on it. When jq parses the crafted input it performs an out-of-bounds write, crashing the process or corrupting memory and potentially disrupting the automation. … |
| Remediation | Upgrade the Alpine jq package to the fixed build 1.8.2-r0 or later (for example, apk update && apk add --upgrade jq), and on non-Alpine systems track the corresponding upstream jq release referenced in GHSA-cfh2-vwfq-qfmm (https://github.com/jqlang/jq/security/advisories/GHSA-cfh2-vwfq-qfmm). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all systems and workflows using jq and identify which accept external or untrusted JSON inputs; document jq versions in use. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which ha
Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (cras
jq is a command-line JSON processor. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no auth
The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and applicat
decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" inpu
jq is a command-line JSON processor. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Publ
jq is a command-line JSON processor. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Publ
Heap buffer overflow in jq command-line JSON processor (all versions through 1.8.1) allows remote unauthenticated attack
jq, the command-line JSON processor, was patched in Alpine Linux with package version 1.8.2-r0. The specific vulnerabili
jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() AP
jq on Alpine Linux was patched in package version 1.8.2-r0, addressing an unspecified vulnerability. The nature of the f
Buffer overflow in jq 1.8.1 and earlier allows local attackers to cause denial of service by providing a crafted JSON nu
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today