Every CVE Search/ Get API key

CVE-2025-49014

jq heap use after free vulnerability in f_strflocaltime

5.5 MediumFix available

jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_strflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known fix version exists at time of publication.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.39%Up 0.3 points since Jun 20, 2025
90%50%10%1%

What each source reports

CVE List Score used 5.5

jq heap use after free vulnerability in f_strflocaltime

jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_strflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known fix version exists at time of publication.

Record
CVE-2025-49014
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Weakness
CWE-416
Updated
2026-11-02
EUVDEUVD-2025-18920 5.5

jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_strflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known fix version exists at time of publication.

Record
EUVD-2025-18920
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
NVD 5.5

jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_strflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known fix version exists at time of publication.

Record
CVE-2025-49014
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-416
Updated
2026-11-02
OSVALPINE-CVE-2025-49014 5.5

jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_strflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known fix version exists at time of publication.

Record
ALPINE-CVE-2025-49014
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSV 5.5

jq heap use after free vulnerability in f_strflocaltime

jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_strflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known fix version exists at time of publication.

Record
CVE-2025-49014
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Weakness
CWE-416
Updated
2026-11-02
OSVDEBIAN-CVE-2025-49014 5.5

jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_strflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known fix version exists at time of publication.

Record
DEBIAN-CVE-2025-49014
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2025-1809 7.5

jq security update

jq is a lightweight and flexible command-line JSON processor. you can use it to slice and filter and map and transform structured data. It is written in portable C, and it has zero runtime dependencies. it can mangle the data format that you have into the one that you want.

Security Fix(es):

jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.(CVE-2024-23337)

jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function jv_string_vfmt in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 void* p = malloc(sz);. As of time of publication, no patched versions are available.(CVE-2025-48060)

jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_strflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known fix version exists at time of publication.(CVE-2025-49014)

Record
OESA-2025-1809
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-49014 5.5

jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_strflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known fix version exists at time of publication.

Record
UBUNTU-CVE-2025-49014
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
OSVopenSUSE-SU-2025:15233-1 No score

jq-1.8.1-1.1 on GA media

These are all security issues fixed in the jq-1.8.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15233-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
jq
Alpine:v3.22
 before 1.8.1-r0
1.8.1-r0
jq
Alpine:v3.23
 before 1.8.1-r0
1.8.1-r0
jq
Alpine:v3.24
 before 1.8.1-r0
1.8.1-r0
jq
Alpaquita:25
 1.8.0-r0 up to 1.8.1-r0
1.8.1-r0
jq
Alpaquita:stream
 1.8.0-r0 up to 1.8.1-r0
1.8.1-r0
jq
Debian:14
 before 1.8.1-1, plus listed versions
1.8.0-1
1.8.1-1
jq
openEuler:22.03-LTS-SP3
 before 1.8.0-2.oe2203sp3
1.8.0-2.oe2203sp3
jq
openEuler:22.03-LTS-SP4
 before 1.8.0-2.oe2203sp4
1.8.0-2.oe2203sp4
jq
openEuler:24.03-LTS
 before 1.8.0-2.oe2403sp2
1.8.0-2.oe2403sp2
jq
openEuler:24.03-LTS-SP1
 before 1.8.0-2.oe2403sp1
1.8.0-2.oe2403sp1
jq
openEuler:24.03-LTS-SP2
 before 1.8.0-2.oe2403sp2
1.8.0-2.oe2403sp2
jq
openEuler:20.03-LTS-SP4
 before 1.8.0-2.oe2003sp4
1.8.0-2.oe2003sp4
jq
openSUSE:Tumbleweed
 before 1.8.1-1.1
1.8.1-1.1

History

History
RecordedChangedSources
affected
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-49014 is a medium vulnerability (CVSS 5.5) in Jqlang Jq, published June 19, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 32nd percentile. Fixed in jq 1.8.1-r0.

References

Show 9 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open