CVE-2025-48060

jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function jv_string_vfmt in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 void* p = malloc(sz);. As of time of publication, no patched versions are available.

jq is a lightweight and flexible command-line JSON processor. you can use it to slice and filter and map and transform structured data. It is written in portable C, and it has zero runtime dependencies. it can mangle the data format that you have into the one that you want.

Security Fix(es):

jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.(CVE-2024-23337)

jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function jv_string_vfmt in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 void* p = malloc(sz);. As of time of publication, no patched versions are available.(CVE-2025-48060)

jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_strflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known fix version exists at time of publication.(CVE-2025-49014)

jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text.

Security Fix(es):

• jq: jq has signed integer overflow in jv.c:jvp_array_write (CVE-2024-23337)

• jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text.

Security Fix(es):

• jq: jq has signed integer overflow in jv.c:jvp_array_write (CVE-2024-23337)

• jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text.

Security Fix(es):

• jq: jq has signed integer overflow in jv.c:jvp_array_write (CVE-2024-23337)

• jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function jv_string_vfmt in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 void* p = malloc(sz);. As of time of publication, no patched versions are available.

jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text.

Security Fix(es):

• jq: jq has signed integer overflow in jv.c:jvp_array_write (CVE-2024-23337)
• jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text.

Security Fix(es):

• jq: jq has signed integer overflow in jv.c:jvp_array_write (CVE-2024-23337)
• jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function jv_string_vfmt in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 void* p = malloc(sz);. As of time of publication, no patched versions are available.

jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function jv_string_vfmt in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 void* p = malloc(sz);. As of time of publication, no patched versions are available.

• CVE-2025-48060: fix heap-buffer-overflow in function jv_string_vfmt in jq_fuzz_execute by adding boundary checks

An integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. (CVE-2024-23337) It was discovered that jq did not correctly handle certain string concatenations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-32316) It was discovered that jq did not correctly handle recursion in certain circumstances. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-33947) It was discovered that jq did not correctly handle improperly terminated strings. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-33948) It was discovered that jq did not correctly handle checking certain variable types. An attacker could possibly use this issue to cause a denial of service or leak sensitive information. (CVE-2026-39956) It was discovered that jq did not correctly handle certain string formatting. An attacker could possibly use this issue to leak sensitive information or cause a denial of service. (CVE-2026-39979) It was discovered that jq used a fixed seed for hash table operations. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-40164) A heap-buffer-overflow is present in function jv_string_vfmt in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 `void* p = malloc(sz); (CVE-2025-48060) Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed. (CVE-2026-41256) The ordinary module loader recurses without cycle detection when two otherwise valid modules include each other (CVE-2026-44777)

These are all security issues fixed in the jq-1.8.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for jq fixes the following issues:

• CVE-2025-48060: improper handling of string data in jv_string_empty can lead to heap buffer overflow and a crash when processing crafted input (bsc#1244116).
• CVE-2026-32316: integer overflow within the jvp_string_append() and jvp_string_copy_replace_bad functions can lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).
• CVE-2026-33947: unbounded recursion in functions jv_setpath(), jv_getpath(), and delpaths_sorted() can lead to excessive resource consumption when processing crafted JSON input (bsc#1262069).
• CVE-2026-39956: missing runtime type checks in _strindices and jv_string_indexes() can lead to a crash when evaluating untrusted jq filters against a release build (bsc#1262070).
• CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in jv_parse_sized can lead to an out-of-bounds read when processing malformed JSON (bsc#1262071).
• CVE-2026-40164: use of MurmurHash3 with a hardcoded seed allows pre-computation of key collisions and can lead to a denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).
• CVE-2026-40612: recursion into nested arrays/objects with no depth limit in jv_contains can lead to a C stack exhaustion when processing crafted input (bsc#1265060).
• CVE-2026-41256: truncation of top-level jq programs loaded with -f and can lead to the execution of unintended programs (bsc#1265061).
• CVE-2026-41257: integer overflow in stack_reallocate can lead to memory corruption and DoS when processing jq bytecode (bsc#1265062).
• CVE-2026-43894: signed integer overflow in the decNumberFromString D2U() macro can lead to an out-of-bounds memory write when processing large number literals (bsc#1265070).
• CVE-2026-33948: improper handling of buffer sizes via strlen() instead of fgets() in CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).

Root has patched CVE-2025-48060 in the rootio-jq package for Root:Debian:12. Multiple fixed versions available.

This update for jq fixes the following issues:

• CVE-2025-48060: Fixed stack-buffer-overflow in jq_fuzz_execute (bsc#1244116)

This update for jq fixes the following issues:

• CVE-2025-48060: Fixed stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (bsc#1244116)
• CVE-2024-23337: Fixed signed integer overflow in jv.c:jvp_array_write (bsc#1243450)
• CVE-2024-53427: Fixed stack-buffer-overflow in the decNumberCopy function in decNumber.c (bsc#1238078)

This update for jq fixes the following issues:

• CVE-2025-48060: Fixed stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (bsc#1244116).

This update for jq fixes the following issues:

• CVE-2025-48060: improper handling of string data in jv_string_empty can lead to heap buffer overflow and a crash when processing crafted input (bsc#1244116).
• CVE-2026-32316: integer overflow within the jvp_string_append() and jvp_string_copy_replace_bad functions can lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).
• CVE-2026-33947: unbounded recursion in functions jv_setpath(), jv_getpath(), and delpaths_sorted() can lead to excessive resource consumption when processing crafted JSON input (bsc#1262069).
• CVE-2026-39956: missing runtime type checks in _strindices and jv_string_indexes() can lead to a crash when evaluating untrusted jq filters against a release build (bsc#1262070).
• CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in jv_parse_sized can lead to an out-of-bounds read when processing malformed JSON (bsc#1262071).
• CVE-2026-40164: use of MurmurHash3 with a hardcoded seed allows pre-computation of key collisions and can lead to a denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).
• CVE-2026-40612: recursion into nested arrays/objects with no depth limit in jv_contains can lead to a C stack exhaustion when processing crafted input (bsc#1265060).
• CVE-2026-41256: truncation of top-level jq programs loaded with -f and can lead to the execution of unintended programs (bsc#1265061).
• CVE-2026-41257: integer overflow in stack_reallocate can lead to memory corruption and DoS when processing jq bytecode (bsc#1265062).
• CVE-2026-43894: signed integer overflow in the decNumberFromString D2U() macro can lead to an out-of-bounds memory write when processing large number literals (bsc#1265070).
• CVE-2026-33948: improper handling of buffer sizes via strlen() instead of fgets() in CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).

This update for jq fixes the following issues:

• CVE-2025-48060: improper handling of string data in jv_string_empty can lead to heap buffer overflow and a crash when processing crafted input (bsc#1244116).
• CVE-2026-32316: integer overflow within the jvp_string_append() and jvp_string_copy_replace_bad functions can lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).
• CVE-2026-33947: unbounded recursion in functions jv_setpath(), jv_getpath(), and delpaths_sorted() can lead to excessive resource consumption when processing crafted JSON input (bsc#1262069).
• CVE-2026-39956: missing runtime type checks in _strindices and jv_string_indexes() can lead to a crash when evaluating untrusted jq filters against a release build (bsc#1262070).
• CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in jv_parse_sized can lead to an out-of-bounds read when processing malformed JSON (bsc#1262071).
• CVE-2026-40164: use of MurmurHash3 with a hardcoded seed allows pre-computation of key collisions and can lead to a denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).
• CVE-2026-40612: recursion into nested arrays/objects with no depth limit in jv_contains can lead to a C stack exhaustion when processing crafted input (bsc#1265060).
• CVE-2026-41256: truncation of top-level jq programs loaded with -f and can lead to the execution of unintended programs (bsc#1265061).
• CVE-2026-41257: integer overflow in stack_reallocate can lead to memory corruption and DoS when processing jq bytecode (bsc#1265062).
• CVE-2026-43894: signed integer overflow in the decNumberFromString D2U() macro can lead to an out-of-bounds memory write when processing large number literals (bsc#1265070).
• CVE-2026-33948: improper handling of buffer sizes via strlen() instead of fgets() in CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).

It was discovered that jq incorrectly handled certain values when parsing JSON data. A remote attacker could possibly use this issue to cause jq to crash, resulting in a denial of service. (CVE-2024-23337)

It was discovered that jq incorrectly handled NaN values when parsing JSON data. A remote attacker could possibly use this issue to cause jq to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS, and Ubuntu 25.04. (CVE-2024-53427)

It was discovered that jq incorrectly handled certain values when parsing JSON data. A remote attacker could use this issue to cause jq to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-48060)

USN-7657-1 fixed CVE-2024-23337 and CVE-2025-48060 in jq. This update provides the corresponding fixes for Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 16.04 LTS.

Original advisory details:

It was discovered that jq incorrectly handled certain values when parsing JSON data. A remote attacker could possibly use this issue to cause jq to crash, resulting in a denial of service. (CVE-2024-23337)

It was discovered that jq incorrectly handled certain values when parsing JSON data. A remote attacker could use this issue to cause jq to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-48060)