Jqlang
Monthly
Heap buffer overflow in jq command-line JSON processor (all versions through 1.8.1) allows remote unauthenticated attackers to crash processes or potentially achieve code execution via crafted queries producing strings exceeding 2^31 bytes. Integer overflow in jvp_string_append() and jvp_string_copy_replace_bad() functions causes undersized buffer allocation followed by heap corruption. Publicly available exploit code exists (SSVC: POC). EPSS score of 0.04% (12th percentile) suggests low observe
Out-of-bounds write in the jq command-line JSON processor (CWE-787) lets a crafted JSON input corrupt memory when parsed, threatening the integrity and availability of the processing host. Tracked upstream as GHSA-cfh2-vwfq-qfmm and packaged by Alpine Linux, the flaw requires a victim to run jq against attacker-controlled data (local vector, user interaction required). No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was provided.
Unbounded recursion in jq 1.8.1 and earlier causes denial of service via crafted jq programs using the * operator on nested objects, resulting in process crash with segmentation fault. Local attackers can exploit this vulnerability without authentication to crash jq processes, affecting any system processing untrusted jq filter logic.
jq versions 1.8.1 and earlier allow local authenticated users to bypass import path validation through NUL byte injection, enabling access to unintended files and potential information disclosure. An attacker with local access can craft a jq script containing embedded NUL bytes in import paths that pass policy validation checks but resolve to arbitrary files on disk via C string operations, circumventing intended access controls.
jq 1.8.2rc1 and earlier suffers from infinite recursion in the module loader when two modules include each other circularly, causing denial of service through resource exhaustion. The vulnerability requires user interaction (loading a crafted jq script with circular module dependencies) on local systems. CVSS 5.4 (CVSS:4.0/AV:L/AC:L/PR:N/UI:P) reflects availability impact only; no remote exploitation vector exists. No public exploit code or active exploitation reported at time of analysis.
Buffer overflow in jq 1.8.1 and earlier allows local attackers to cause denial of service by providing a crafted JSON number literal with INT_MAX-1 (2147483646) digits, triggering integer overflow in the D2U() macro that bypasses heap-allocation checks and writes approximately 1.4 GiB of attacker-controlled data to the stack, corrupting memory far below the stack frame.
Jq 1.8.1 and earlier truncate filter files at the first embedded NUL byte when loaded with -f, causing only the prefix before the NUL to execute. A crafted filter file containing a NUL byte and arbitrary suffix allows an attacker to inject malicious code that compiles and runs silently, bypassing intended filter logic and potentially modifying JSON output in undetected ways. This represents a post-CVE-2026-33948 regression on the compilation path.
jq 1.8.1 and earlier are vulnerable to stack exhaustion via unbounded recursion in the jv_contains function when processing deeply nested JSON structures. An attacker can craft a malicious JSON input with excessive nesting depth that exhausts the C stack, causing denial of service. The vulnerability requires user interaction to process the malicious input, and CVSS indicates availability impact with exploitability probability.
Integer overflow in jq's bytecode VM data stack allocation tracking allows local attackers to corrupt heap memory and achieve arbitrary code execution or denial of service by crafting deeply nested JSON generator expressions that exceed ~1 GiB stack size. Affected versions: jq 1.8.1 and earlier. The vulnerability requires local file access and user interaction to trigger malicious jq expressions, but carries high impact potential due to memory corruption exploitability.
Input validation bypass in jq command-line JSON processor allows attackers to craft JSON with embedded NUL bytes that jq incorrectly truncates, validating only a benign prefix while silently discarding malicious trailing data. Versions before commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b are affected; the vulnerability enables parser differential attacks where jq validates hostile input as safe JSON, but downstream consumers process the complete input including injected payloads. With low CVSS (2.9) and attack timing complexity, exploitation risk remains moderate in scenarios where jq serves as a validation gate for untrusted JSON forwarded to other processors.
Out-of-bounds read in libjq's jv_parse_sized() API exposes any embedding application to memory disclosure or process termination when processing malformed JSON in non-NUL-terminated buffers. All jq releases before commit 2f09060afab23fe9390cce7cb860b10416e1bf5f are affected per CPE cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*. SSVC marks the flaw as automatable with a POC noted, though EPSS sits at only 0.04% and CISA KEV has not listed it, indicating no confirmed widespread exploitation at time of analysis.
Out-of-bounds read in jq release builds allows an attacker who controls filter input to crash the processor or probe process memory by passing a non-string argument to the _strindices builtin. Release builds compiled with -DNDEBUG strip the assert() type guards in jv_string_indexes(), enabling a type confusion that escalates from trivial denial-of-service to a controlled pointer dereference and limited memory read primitive via IEEE-754 bit-pattern manipulation. Publicly available exploit code exists per SSVC; EPSS remains at 0.01% (2nd percentile), indicating no widespread exploitation, and the attack is not in CISA KEV.
Stack exhaustion denial of service in jq 1.8.1 and below allows an attacker who controls JSON input to a filter using setpath, getpath, or delpaths built-ins to crash the processing application with a SIGSEGV by supplying a flat array of approximately 65,000 integers (~200 KB) as a path argument. The unbounded recursion in jv_setpath(), jv_getpath(), and delpaths_sorted() (src/jv_aux.c) is limited only by the C call stack, not by any runtime depth guard - the existing MAX_PARSING_DEPTH (10,000) guard applies exclusively to the JSON parser and does not protect path operations. Publicly available exploit code exists per SSVC analysis; no active exploitation is confirmed in CISA KEV, and the EPSS score of 0.01% (2nd percentile) suggests limited current adversary interest.
A vulnerability was determined in jqlang jq up to 1.6. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
jq is a command-line JSON processor. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
jq is a command-line JSON processor. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as. Rated high severity (CVSS 8.1), this vulnerability is no authentication required. Public exploit code available and no vendor patch available.
jq is a command-line JSON processor. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.
jq is a command-line JSON processor. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.
decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" input. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
jq on Alpine Linux was patched in package version 1.8.2-r0, addressing an unspecified vulnerability. The nature of the flaw - whether it is a memory corruption issue, denial of service via crafted JSON input, or another class - is not disclosed in available data. No CVSS score, CWE classification, or technical description has been published; this entry originates solely from an Alpine Linux vendor advisory.
jq, the command-line JSON processor, was patched in Alpine Linux with package version 1.8.2-r0. The specific vulnerability details - including the nature of the flaw, affected upstream jq versions, and precise impact - are not disclosed in the available intelligence. The sole data point is a vendor-sourced fix notification from Alpine Linux, making a full characterization of attacker capability and affected scope impossible at this time.
Heap buffer overflow in jq command-line JSON processor (all versions through 1.8.1) allows remote unauthenticated attackers to crash processes or potentially achieve code execution via crafted queries producing strings exceeding 2^31 bytes. Integer overflow in jvp_string_append() and jvp_string_copy_replace_bad() functions causes undersized buffer allocation followed by heap corruption. Publicly available exploit code exists (SSVC: POC). EPSS score of 0.04% (12th percentile) suggests low observe
Out-of-bounds write in the jq command-line JSON processor (CWE-787) lets a crafted JSON input corrupt memory when parsed, threatening the integrity and availability of the processing host. Tracked upstream as GHSA-cfh2-vwfq-qfmm and packaged by Alpine Linux, the flaw requires a victim to run jq against attacker-controlled data (local vector, user interaction required). No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was provided.
Unbounded recursion in jq 1.8.1 and earlier causes denial of service via crafted jq programs using the * operator on nested objects, resulting in process crash with segmentation fault. Local attackers can exploit this vulnerability without authentication to crash jq processes, affecting any system processing untrusted jq filter logic.
jq versions 1.8.1 and earlier allow local authenticated users to bypass import path validation through NUL byte injection, enabling access to unintended files and potential information disclosure. An attacker with local access can craft a jq script containing embedded NUL bytes in import paths that pass policy validation checks but resolve to arbitrary files on disk via C string operations, circumventing intended access controls.
jq 1.8.2rc1 and earlier suffers from infinite recursion in the module loader when two modules include each other circularly, causing denial of service through resource exhaustion. The vulnerability requires user interaction (loading a crafted jq script with circular module dependencies) on local systems. CVSS 5.4 (CVSS:4.0/AV:L/AC:L/PR:N/UI:P) reflects availability impact only; no remote exploitation vector exists. No public exploit code or active exploitation reported at time of analysis.
Buffer overflow in jq 1.8.1 and earlier allows local attackers to cause denial of service by providing a crafted JSON number literal with INT_MAX-1 (2147483646) digits, triggering integer overflow in the D2U() macro that bypasses heap-allocation checks and writes approximately 1.4 GiB of attacker-controlled data to the stack, corrupting memory far below the stack frame.
Jq 1.8.1 and earlier truncate filter files at the first embedded NUL byte when loaded with -f, causing only the prefix before the NUL to execute. A crafted filter file containing a NUL byte and arbitrary suffix allows an attacker to inject malicious code that compiles and runs silently, bypassing intended filter logic and potentially modifying JSON output in undetected ways. This represents a post-CVE-2026-33948 regression on the compilation path.
jq 1.8.1 and earlier are vulnerable to stack exhaustion via unbounded recursion in the jv_contains function when processing deeply nested JSON structures. An attacker can craft a malicious JSON input with excessive nesting depth that exhausts the C stack, causing denial of service. The vulnerability requires user interaction to process the malicious input, and CVSS indicates availability impact with exploitability probability.
Integer overflow in jq's bytecode VM data stack allocation tracking allows local attackers to corrupt heap memory and achieve arbitrary code execution or denial of service by crafting deeply nested JSON generator expressions that exceed ~1 GiB stack size. Affected versions: jq 1.8.1 and earlier. The vulnerability requires local file access and user interaction to trigger malicious jq expressions, but carries high impact potential due to memory corruption exploitability.
Input validation bypass in jq command-line JSON processor allows attackers to craft JSON with embedded NUL bytes that jq incorrectly truncates, validating only a benign prefix while silently discarding malicious trailing data. Versions before commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b are affected; the vulnerability enables parser differential attacks where jq validates hostile input as safe JSON, but downstream consumers process the complete input including injected payloads. With low CVSS (2.9) and attack timing complexity, exploitation risk remains moderate in scenarios where jq serves as a validation gate for untrusted JSON forwarded to other processors.
Out-of-bounds read in libjq's jv_parse_sized() API exposes any embedding application to memory disclosure or process termination when processing malformed JSON in non-NUL-terminated buffers. All jq releases before commit 2f09060afab23fe9390cce7cb860b10416e1bf5f are affected per CPE cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*. SSVC marks the flaw as automatable with a POC noted, though EPSS sits at only 0.04% and CISA KEV has not listed it, indicating no confirmed widespread exploitation at time of analysis.
Out-of-bounds read in jq release builds allows an attacker who controls filter input to crash the processor or probe process memory by passing a non-string argument to the _strindices builtin. Release builds compiled with -DNDEBUG strip the assert() type guards in jv_string_indexes(), enabling a type confusion that escalates from trivial denial-of-service to a controlled pointer dereference and limited memory read primitive via IEEE-754 bit-pattern manipulation. Publicly available exploit code exists per SSVC; EPSS remains at 0.01% (2nd percentile), indicating no widespread exploitation, and the attack is not in CISA KEV.
Stack exhaustion denial of service in jq 1.8.1 and below allows an attacker who controls JSON input to a filter using setpath, getpath, or delpaths built-ins to crash the processing application with a SIGSEGV by supplying a flat array of approximately 65,000 integers (~200 KB) as a path argument. The unbounded recursion in jv_setpath(), jv_getpath(), and delpaths_sorted() (src/jv_aux.c) is limited only by the C call stack, not by any runtime depth guard - the existing MAX_PARSING_DEPTH (10,000) guard applies exclusively to the JSON parser and does not protect path operations. Publicly available exploit code exists per SSVC analysis; no active exploitation is confirmed in CISA KEV, and the EPSS score of 0.01% (2nd percentile) suggests limited current adversary interest.
A vulnerability was determined in jqlang jq up to 1.6. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
jq is a command-line JSON processor. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
jq is a command-line JSON processor. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as. Rated high severity (CVSS 8.1), this vulnerability is no authentication required. Public exploit code available and no vendor patch available.
jq is a command-line JSON processor. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.
jq is a command-line JSON processor. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.
decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" input. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
jq on Alpine Linux was patched in package version 1.8.2-r0, addressing an unspecified vulnerability. The nature of the flaw - whether it is a memory corruption issue, denial of service via crafted JSON input, or another class - is not disclosed in available data. No CVSS score, CWE classification, or technical description has been published; this entry originates solely from an Alpine Linux vendor advisory.
jq, the command-line JSON processor, was patched in Alpine Linux with package version 1.8.2-r0. The specific vulnerability details - including the nature of the flaw, affected upstream jq versions, and precise impact - are not disclosed in the available intelligence. The sole data point is a vendor-sourced fix notification from Alpine Linux, making a full characterization of attacker capability and affected scope impossible at this time.