CVE-2026-49839

jq is a command-line JSON processor. Prior to 1.8.2, jq --rawfile can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds. When jv_load_file(raw=1) reads an attacker-controlled file, it repeatedly appends file chunks to the same jv string accumulator. Once jv_string_append_buf() returns jv_invalid_with_msg("String too long"), the raw-file loop does not stop. If the file contains at least one more byte, the next loop iteration appends a new chunk to an object that is already invalid. With assertions enabled this aborts in jvp_string_ptr(). With assertions disabled, the invalid object is interpreted as a string object and ASan reports heap-buffer-overflow. This vulnerability is fixed in 1.8.2.

jq is a lightweight and flexible command-line JSON processor. you can use it to slice and filter and map and transform structured data. It is written in portable C, and it has zero runtime dependencies. it can mangle the data format that you have into the one that you want.

Security Fix(es):

jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion (uncontrolled recursion). The crash occurs in jq's recursive structural comparison code, with the recursion repeating through jvp_array_equal() and jv_equal() in src/jv.c when comparing deeply nested arrays; a nearby sort comparator path through jv_cmp() in src/jv_aux.c overflows the stack at a larger nesting depth from the same missing recursion guard. Anyone running jq comparisons on attacker-controlled deeply nested JSON values, or embedding jq in a context where untrusted data can reach the == comparison path, is affected. This vulnerability is fixed in 1.8.2.(CVE-2026-47770)

jq is a command-line JSON processor. Prior to 1.8.2, jq --rawfile can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds. When jv_load_file(raw=1) reads an attacker-controlled file, it repeatedly appends file chunks to the same jv string accumulator. Once jv_string_append_buf() returns jv_invalid_with_msg("String too long"), the raw-file loop does not stop. If the file contains at least one more byte, the next loop iteration appends a new chunk to an object that is already invalid. With assertions enabled this aborts in jvp_string_ptr(). With assertions disabled, the invalid object is interpreted as a string object and ASan reports heap-buffer-overflow. This vulnerability is fixed in 1.8.2.(CVE-2026-49839)

jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvp_string_append has a chance of integer/multiple overflowing and then causing a massive buffer overrun. This vulnerability is fixed in 1.8.2.(CVE-2026-54679)

jq is a lightweight and flexible command-line JSON processor. you can use it to slice and filter and map and transform structured data. It is written in portable C, and it has zero runtime dependencies. it can mangle the data format that you have into the one that you want.

Security Fix(es):

jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion (uncontrolled recursion). The crash occurs in jq's recursive structural comparison code, with the recursion repeating through jvp_array_equal() and jv_equal() in src/jv.c when comparing deeply nested arrays; a nearby sort comparator path through jv_cmp() in src/jv_aux.c overflows the stack at a larger nesting depth from the same missing recursion guard. Anyone running jq comparisons on attacker-controlled deeply nested JSON values, or embedding jq in a context where untrusted data can reach the == comparison path, is affected. This vulnerability is fixed in 1.8.2.(CVE-2026-47770)

jq is a command-line JSON processor. Prior to 1.8.2, jq --rawfile can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds. When jv_load_file(raw=1) reads an attacker-controlled file, it repeatedly appends file chunks to the same jv string accumulator. Once jv_string_append_buf() returns jv_invalid_with_msg("String too long"), the raw-file loop does not stop. If the file contains at least one more byte, the next loop iteration appends a new chunk to an object that is already invalid. With assertions enabled this aborts in jvp_string_ptr(). With assertions disabled, the invalid object is interpreted as a string object and ASan reports heap-buffer-overflow. This vulnerability is fixed in 1.8.2.(CVE-2026-49839)

jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvp_string_append has a chance of integer/multiple overflowing and then causing a massive buffer overrun. This vulnerability is fixed in 1.8.2.(CVE-2026-54679)

jq is a lightweight and flexible command-line JSON processor. you can use it to slice and filter and map and transform structured data. It is written in portable C, and it has zero runtime dependencies. it can mangle the data format that you have into the one that you want.

Security Fix(es):

jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion (uncontrolled recursion). The crash occurs in jq's recursive structural comparison code, with the recursion repeating through jvp_array_equal() and jv_equal() in src/jv.c when comparing deeply nested arrays; a nearby sort comparator path through jv_cmp() in src/jv_aux.c overflows the stack at a larger nesting depth from the same missing recursion guard. Anyone running jq comparisons on attacker-controlled deeply nested JSON values, or embedding jq in a context where untrusted data can reach the == comparison path, is affected. This vulnerability is fixed in 1.8.2.(CVE-2026-47770)

jq is a command-line JSON processor. Prior to 1.8.2, jq --rawfile can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds. When jv_load_file(raw=1) reads an attacker-controlled file, it repeatedly appends file chunks to the same jv string accumulator. Once jv_string_append_buf() returns jv_invalid_with_msg("String too long"), the raw-file loop does not stop. If the file contains at least one more byte, the next loop iteration appends a new chunk to an object that is already invalid. With assertions enabled this aborts in jvp_string_ptr(). With assertions disabled, the invalid object is interpreted as a string object and ASan reports heap-buffer-overflow. This vulnerability is fixed in 1.8.2.(CVE-2026-49839)

jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvp_string_append has a chance of integer/multiple overflowing and then causing a massive buffer overrun. This vulnerability is fixed in 1.8.2.(CVE-2026-54679)

jq is a lightweight and flexible command-line JSON processor. you can use it to slice and filter and map and transform structured data. It is written in portable C, and it has zero runtime dependencies. it can mangle the data format that you have into the one that you want.

Security Fix(es):

jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion (uncontrolled recursion). The crash occurs in jq's recursive structural comparison code, with the recursion repeating through jvp_array_equal() and jv_equal() in src/jv.c when comparing deeply nested arrays; a nearby sort comparator path through jv_cmp() in src/jv_aux.c overflows the stack at a larger nesting depth from the same missing recursion guard. Anyone running jq comparisons on attacker-controlled deeply nested JSON values, or embedding jq in a context where untrusted data can reach the == comparison path, is affected. This vulnerability is fixed in 1.8.2.(CVE-2026-47770)

jq is a command-line JSON processor. Prior to 1.8.2, jq --rawfile can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds. When jv_load_file(raw=1) reads an attacker-controlled file, it repeatedly appends file chunks to the same jv string accumulator. Once jv_string_append_buf() returns jv_invalid_with_msg("String too long"), the raw-file loop does not stop. If the file contains at least one more byte, the next loop iteration appends a new chunk to an object that is already invalid. With assertions enabled this aborts in jvp_string_ptr(). With assertions disabled, the invalid object is interpreted as a string object and ASan reports heap-buffer-overflow. This vulnerability is fixed in 1.8.2.(CVE-2026-49839)

jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvp_string_append has a chance of integer/multiple overflowing and then causing a massive buffer overrun. This vulnerability is fixed in 1.8.2.(CVE-2026-54679)

jq is a command-line JSON processor. Prior to 1.8.2, jq --rawfile can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds. When jv_load_file(raw=1) reads an attacker-controlled file, it repeatedly appends file chunks to the same jv string accumulator. Once jv_string_append_buf() returns jv_invalid_with_msg("String too long"), the raw-file loop does not stop. If the file contains at least one more byte, the next loop iteration appends a new chunk to an object that is already invalid. With assertions enabled this aborts in jvp_string_ptr(). With assertions disabled, the invalid object is interpreted as a string object and ASan reports heap-buffer-overflow. This vulnerability is fixed in 1.8.2.

jq is a command-line JSON processor. Prior to 1.8.2, jq --rawfile can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds. When jv_load_file(raw=1) reads an attacker-controlled file, it repeatedly appends file chunks to the same jv string accumulator. Once jv_string_append_buf() returns jv_invalid_with_msg("String too long"), the raw-file loop does not stop. If the file contains at least one more byte, the next loop iteration appends a new chunk to an object that is already invalid. With assertions enabled this aborts in jvp_string_ptr(). With assertions disabled, the invalid object is interpreted as a string object and ASan reports heap-buffer-overflow. This vulnerability is fixed in 1.8.2.

• CVE-2026-49839: fix heap-buffer-overflow in raw file loading

• CVE-2026-49839: break out of the raw file load loop when jv_string_append_buf returns an invalid value to prevent a heap-buffer-overflow

Embedded NUL truncates top-level jq programs loaded with -f. (CVE-2026-41256) Signed-int overflow in stack_reallocate (jq VM stack). (CVE-2026-41257) Wild stack write via signed-integer overflow in decNumber D2U() macro. (CVE-2026-43894) Embedded NUL in jq import paths causes local redaction-policy bypass and preserves sensitive fields in published artifacts. (CVE-2026-43895) Stack Overflow in Recursive Object Merge. (CVE-2026-43896) Stack overflow in module loading on mutual include. (CVE-2026-44777) Stack overflow in deep structural equality. (CVE-2026-47770) jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow. (CVE-2026-49839) Potential integer overflow in jvp_string_append. (CVE-2026-54679)

These are all security issues fixed in the jq-1.8.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for jq fixes the following issues

• CVE-2026-43896: unbounded recursion in jv_object_merge_recursive() can lead to C stack exhaustion and a process crash (bsc#1265075).
• CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules include each other can lead to stack exhaustion and process crash (bsc#1265076).
• CVE-2026-49839: fixed a bug where jq --rawfile can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds (bsc#1269220).
• CVE-2026-54679: integer overflow in jvp_string_append can lead to a buffer overrun on 32-bit systems (bsc#1269390).

Root has patched CVE-2026-49839 in the rootio-jq package for Root:Debian:12. Multiple fixed versions available.

This update for jq fixes the following issues

• CVE-2026-43896: unbounded recursion in jv_object_merge_recursive() can lead to C stack exhaustion and a process crash (bsc#1265075).
• CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules include each other can lead to stack exhaustion and process crash (bsc#1265076).
• CVE-2026-49839: fixed a bug where jq --rawfile can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds (bsc#1269220).
• CVE-2026-54679: integer overflow in jvp_string_append can lead to a buffer overrun on 32-bit systems (bsc#1269390).

This update for jq fixes the following issues

• CVE-2026-43896: unbounded recursion in jv_object_merge_recursive() can lead to C stack exhaustion and a process crash (bsc#1265075).
• CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules include each other can lead to stack exhaustion and process crash (bsc#1265076).
• CVE-2026-49839: fixed a bug where jq --rawfile can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds (bsc#1269220).
• CVE-2026-54679: integer overflow in jvp_string_append can lead to a buffer overrun on 32-bit systems (bsc#1269390).

This update for jq fixes the following issues

• CVE-2026-43896: unbounded recursion in jv_object_merge_recursive() can lead to C stack exhaustion and a process crash (bsc#1265075).
• CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules include each other can lead to stack exhaustion and process crash (bsc#1265076).
• CVE-2026-49839: fixed a bug where jq --rawfile can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds (bsc#1269220).
• CVE-2026-54679: integer overflow in jvp_string_append can lead to a buffer overrun on 32-bit systems (bsc#1269390).

This update for jq fixes the following issues:

Security issues fixed:

• CVE-2015-8863: heap buffer overflow in tokenadd() function (bsc#976992).
• CVE-2023-50246: improper memory handling can lead to a heap buffer overflow in decNumberToString (bsc#1218034).
• CVE-2023-50268: stack-based buffer overflow in builds using decNumber (bsc#1218038).
• CVE-2024-53427: stack-buffer-overflow in the decNumberCopy function in decNumber.c (bsc#1238078).
• CVE-2025-9403: reachable assertion in run_jq_tests() (bsc#1248600).
• CVE-2026-32316: denial of Service or potential arbitrary code execution due to integer overflow and heap-based buffer overflow (bsc#1262044).
• CVE-2026-33948: CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).
• CVE-2026-40164: predictable hash collisions can lead to a denial of service (bsc#1262072).
• CVE-2026-40612: jv_contains recurses into nested arrays/objects with no depth limit and can cause a stack overflow (bsc#1265060).
• CVE-2026-41256: embedded NUL truncates top-level jq programs loaded with -f and can lead to execution of unintended programs (bsc#1265061).
• CVE-2026-41257: integer overflow in stack_reallocate can lead to memory corruption and DoS (bsc#1265062).
• CVE-2026-43894: signed integer overflow in decNumber can lead to out-of-bounds memory write (bsc#1265070).
• CVE-2026-43895: embedded NUL bytes in import paths can lead to policy bypass and sensitive information disclosure (bsc#1265071).
• CVE-2026-43896: unbounded recursion in jv_object_merge_recursive() can lead to C stack exhaustion and a process crash (bsc#1265075).
• CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules include each other can lead to stack exhaustion and process crash (bsc#1265076).
• CVE-2026-47770: stack overflow in deep structural equality (bsc#1269221).
• CVE-2026-49839: --rawfile invalid-state reuse after String too long can lead to a heap buffer overflow (bsc#1269220).
• CVE-2026-54679: integer overflow in jvp_string_append can lead to a buffer overrun on 32-bit systems (bsc#1269390).

Changes for jq:

Update to version 1.7.1:

• Make the default background color more suitable for bright backgrounds.
• Allow passing the inline jq script after --.
• Fix possible uninitialised value dereference if jq_init() fails
• Simplify paths/0 and paths/1.
• Reject U+001F in string literals.
• Remove unused nref accumulator in block_bind_library.
• Remove a bunch of unused variables, and useless assignments.
• main.c: Remove unused EXIT_STATUS_EXACT option.
• Actually use the number correctly casted from double to int as index.
• src/builtin.c: remove unnecessary jv_copy-s in type_error/type_error2.
• Remove undefined behavior caught by LLVM 10 UBSAN.
• Convert decnum to binary64 (double) instead of decimal64. This makes jq behave like the JSON specification suggests and more similar to other languages.
• Fix memory leaks on invalid input for ltrimstr/1 and rtrimstr/1.
• Fix memory leak on failed get for setpath/2.
• Fix nan from json parsing also for nans with payload that start with 'n'.
• Allow carriage return characters in comments.
• Generate links in the man page.
• Add extern C for C++.
• Make object key color configurable using JQ_COLORS environment variable.
• Change the default color of null to Bright Black.
• Respect NO_COLOR environment variable to disable color output.
• Improved --help output. Now mentions all options and nicer order.
• Fix multiple issues of exit code using --exit-code/-e option.
• Add --raw-output0 for NUL (zero byte) separated output.
• Fix assert crash and validate JSON for --jsonarg.
• Remove deprecated --argfile option.
• Use decimal number literals to preserve precision. Comparison operations respects precision but arithmetic operations might truncate.
• Adds new builtin pick(stream) to emit a projection of the input object or array.
• Adds new builtin…

This update for jq fixes the following issues:

Security issues fixed:

• CVE-2015-8863: heap buffer overflow in tokenadd() function (bsc#976992).
• CVE-2023-50246: improper memory handling can lead to a heap buffer overflow in decNumberToString (bsc#1218034).
• CVE-2023-50268: stack-based buffer overflow in builds using decNumber (bsc#1218038).
• CVE-2024-53427: stack-buffer-overflow in the decNumberCopy function in decNumber.c (bsc#1238078).
• CVE-2025-9403: reachable assertion in run_jq_tests() (bsc#1248600).
• CVE-2026-33948: CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).
• CVE-2026-40164: predictable hash collisions can lead to a denial of service (bsc#1262072).
• CVE-2026-40612: jv_contains recurses into nested arrays/objects with no depth limit and can cause a stack overflow (bsc#1265060).
• CVE-2026-41256: embedded NUL truncates top-level jq programs loaded with -f and can lead to execution of unintended programs (bsc#1265061).
• CVE-2026-41257: integer overflow in stack_reallocate can lead to memory corruption and DoS (bsc#1265062).
• CVE-2026-43894: signed integer overflow in decNumber can lead to out-of-bounds memory write (bsc#1265070).
• CVE-2026-43895: embedded NUL bytes in import paths can lead to policy bypass and sensitive information disclosure (bsc#1265071).
• CVE-2026-43896: unbounded recursion in jv_object_merge_recursive() can lead to C stack exhaustion and a process crash (bsc#1265075).
• CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules include each other can lead to stack exhaustion and process crash (bsc#1265076).
• CVE-2026-47770: stack overflow in deep structural equality (bsc#1269221).
• CVE-2026-49839: --rawfile invalid-state reuse after String too long can lead to a heap buffer overflow (bsc#1269220).
• CVE-2026-54679: integer overflow in jvp_string_append can lead to a buffer overrun on 32-bit systems (bsc#1269390).

Changes for jq:

Update to version 1.7.1:

• Make the default background color more suitable for bright backgrounds.
• Allow passing the inline jq script after --.
• Fix possible uninitialised value dereference if jq_init() fails
• Simplify paths/0 and paths/1.
• Reject U+001F in string literals.
• Remove unused nref accumulator in block_bind_library.
• Remove a bunch of unused variables, and useless assignments.
• main.c: Remove unused EXIT_STATUS_EXACT option.
• Actually use the number correctly casted from double to int as index.
• src/builtin.c: remove unnecessary jv_copy-s in type_error/type_error2.
• Remove undefined behavior caught by LLVM 10 UBSAN.
• Convert decnum to binary64 (double) instead of decimal64. This makes jq behave like the JSON specification suggests and more similar to other languages.
• Fix memory leaks on invalid input for ltrimstr/1 and rtrimstr/1.
• Fix memory leak on failed get for setpath/2.
• Fix nan from json parsing also for nans with payload that start with 'n'.
• Allow carriage return characters in comments.
• Generate links in the man page.
• Add extern C for C++.
• Make object key color configurable using JQ_COLORS environment variable.
• Change the default color of null to Bright Black.
• Respect NO_COLOR environment variable to disable color output.
• Improved --help output. Now mentions all options and nicer order.
• Fix multiple issues of exit code using --exit-code/-e option.
• Add --raw-output0 for NUL (zero byte) separated output.
• Fix assert crash and validate JSON for --jsonarg.
• Remove deprecated --argfile option.
• Use decimal number literals to preserve precision. Comparison operations respects precision but arithmetic operations might truncate.
• Adds new builtin pick(stream) to emit a projection of the input object or array.
• Adds new builtin debug(msgs) that works like debug but applies a filter on the input before writing to stderr.
• Adds new builtin scan($re; $flags). Was documented…