CVE-2015-8863

Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.

Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.

A heap-based buffer overflow flaw was found in jq's tokenadd() function. By tricking a victim into processing a specially crafted JSON file, an attacker could use this flaw to crash jq or, potentially, execute arbitrary code on the victim's system (CVE-2015-8863).

Stack exhaustion could affect availability when parsing untrusted input (CVE-2016-4074).

These are all security issues fixed in the jq-1.5-3.3 package on the GA media of openSUSE Tumbleweed.

This update for jq fixes the following issues:

Security issues fixed:

• CVE-2015-8863: heap buffer overflow in tokenadd() function (bsc#976992).
• CVE-2023-50246: improper memory handling can lead to a heap buffer overflow in decNumberToString (bsc#1218034).
• CVE-2023-50268: stack-based buffer overflow in builds using decNumber (bsc#1218038).
• CVE-2024-53427: stack-buffer-overflow in the decNumberCopy function in decNumber.c (bsc#1238078).
• CVE-2025-9403: reachable assertion in run_jq_tests() (bsc#1248600).
• CVE-2026-32316: denial of Service or potential arbitrary code execution due to integer overflow and heap-based buffer overflow (bsc#1262044).
• CVE-2026-33948: CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).
• CVE-2026-40164: predictable hash collisions can lead to a denial of service (bsc#1262072).
• CVE-2026-40612: jv_contains recurses into nested arrays/objects with no depth limit and can cause a stack overflow (bsc#1265060).
• CVE-2026-41256: embedded NUL truncates top-level jq programs loaded with -f and can lead to execution of unintended programs (bsc#1265061).
• CVE-2026-41257: integer overflow in stack_reallocate can lead to memory corruption and DoS (bsc#1265062).
• CVE-2026-43894: signed integer overflow in decNumber can lead to out-of-bounds memory write (bsc#1265070).
• CVE-2026-43895: embedded NUL bytes in import paths can lead to policy bypass and sensitive information disclosure (bsc#1265071).
• CVE-2026-43896: unbounded recursion in jv_object_merge_recursive() can lead to C stack exhaustion and a process crash (bsc#1265075).
• CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules include each other can lead to stack exhaustion and process crash (bsc#1265076).
• CVE-2026-47770: stack overflow in deep structural equality (bsc#1269221).
• CVE-2026-49839: --rawfile invalid-state reuse after String too long can lead to a heap buffer overflow (bsc#1269220).
• CVE-2026-54679: integer overflow in jvp_string_append can lead to a buffer overrun on 32-bit systems (bsc#1269390).

Changes for jq:

Update to version 1.7.1:

• Make the default background color more suitable for bright backgrounds.
• Allow passing the inline jq script after --.
• Fix possible uninitialised value dereference if jq_init() fails
• Simplify paths/0 and paths/1.
• Reject U+001F in string literals.
• Remove unused nref accumulator in block_bind_library.
• Remove a bunch of unused variables, and useless assignments.
• main.c: Remove unused EXIT_STATUS_EXACT option.
• Actually use the number correctly casted from double to int as index.
• src/builtin.c: remove unnecessary jv_copy-s in type_error/type_error2.
• Remove undefined behavior caught by LLVM 10 UBSAN.
• Convert decnum to binary64 (double) instead of decimal64. This makes jq behave like the JSON specification suggests and more similar to other languages.
• Fix memory leaks on invalid input for ltrimstr/1 and rtrimstr/1.
• Fix memory leak on failed get for setpath/2.
• Fix nan from json parsing also for nans with payload that start with 'n'.
• Allow carriage return characters in comments.
• Generate links in the man page.
• Add extern C for C++.
• Make object key color configurable using JQ_COLORS environment variable.
• Change the default color of null to Bright Black.
• Respect NO_COLOR environment variable to disable color output.
• Improved --help output. Now mentions all options and nicer order.
• Fix multiple issues of exit code using --exit-code/-e option.
• Add --raw-output0 for NUL (zero byte) separated output.
• Fix assert crash and validate JSON for --jsonarg.
• Remove deprecated --argfile option.
• Use decimal number literals to preserve precision. Comparison operations respects precision but arithmetic operations might truncate.
• Adds new builtin pick(stream) to emit a projection of the input object or array.
• Adds new builtin…

This update for jq fixes the following issues:

Security issues fixed:

• CVE-2015-8863: heap buffer overflow in tokenadd() function (bsc#976992).
• CVE-2023-50246: improper memory handling can lead to a heap buffer overflow in decNumberToString (bsc#1218034).
• CVE-2023-50268: stack-based buffer overflow in builds using decNumber (bsc#1218038).
• CVE-2024-53427: stack-buffer-overflow in the decNumberCopy function in decNumber.c (bsc#1238078).
• CVE-2025-9403: reachable assertion in run_jq_tests() (bsc#1248600).
• CVE-2026-33948: CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).
• CVE-2026-40164: predictable hash collisions can lead to a denial of service (bsc#1262072).
• CVE-2026-40612: jv_contains recurses into nested arrays/objects with no depth limit and can cause a stack overflow (bsc#1265060).
• CVE-2026-41256: embedded NUL truncates top-level jq programs loaded with -f and can lead to execution of unintended programs (bsc#1265061).
• CVE-2026-41257: integer overflow in stack_reallocate can lead to memory corruption and DoS (bsc#1265062).
• CVE-2026-43894: signed integer overflow in decNumber can lead to out-of-bounds memory write (bsc#1265070).
• CVE-2026-43895: embedded NUL bytes in import paths can lead to policy bypass and sensitive information disclosure (bsc#1265071).
• CVE-2026-43896: unbounded recursion in jv_object_merge_recursive() can lead to C stack exhaustion and a process crash (bsc#1265075).
• CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules include each other can lead to stack exhaustion and process crash (bsc#1265076).
• CVE-2026-47770: stack overflow in deep structural equality (bsc#1269221).
• CVE-2026-49839: --rawfile invalid-state reuse after String too long can lead to a heap buffer overflow (bsc#1269220).
• CVE-2026-54679: integer overflow in jvp_string_append can lead to a buffer overrun on 32-bit systems (bsc#1269390).

Changes for jq:

Update to version 1.7.1:

• Make the default background color more suitable for bright backgrounds.
• Allow passing the inline jq script after --.
• Fix possible uninitialised value dereference if jq_init() fails
• Simplify paths/0 and paths/1.
• Reject U+001F in string literals.
• Remove unused nref accumulator in block_bind_library.
• Remove a bunch of unused variables, and useless assignments.
• main.c: Remove unused EXIT_STATUS_EXACT option.
• Actually use the number correctly casted from double to int as index.
• src/builtin.c: remove unnecessary jv_copy-s in type_error/type_error2.
• Remove undefined behavior caught by LLVM 10 UBSAN.
• Convert decnum to binary64 (double) instead of decimal64. This makes jq behave like the JSON specification suggests and more similar to other languages.
• Fix memory leaks on invalid input for ltrimstr/1 and rtrimstr/1.
• Fix memory leak on failed get for setpath/2.
• Fix nan from json parsing also for nans with payload that start with 'n'.
• Allow carriage return characters in comments.
• Generate links in the man page.
• Add extern C for C++.
• Make object key color configurable using JQ_COLORS environment variable.
• Change the default color of null to Bright Black.
• Respect NO_COLOR environment variable to disable color output.
• Improved --help output. Now mentions all options and nicer order.
• Fix multiple issues of exit code using --exit-code/-e option.
• Add --raw-output0 for NUL (zero byte) separated output.
• Fix assert crash and validate JSON for --jsonarg.
• Remove deprecated --argfile option.
• Use decimal number literals to preserve precision. Comparison operations respects precision but arithmetic operations might truncate.
• Adds new builtin pick(stream) to emit a projection of the input object or array.
• Adds new builtin debug(msgs) that works like debug but applies a filter on the input before writing to stderr.
• Adds new builtin scan($re; $flags). Was documented…