Every CVE Search/ Get API key

CVE-2026-33948

jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input

2.9 LowFix available

jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.26%Up 0.2 points since Apr 14, 2026
90%50%10%1%

What each source reports

CVE List Score used 2.9

jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input

jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.

Record
CVE-2026-33948
CVSS 4.0
2.9 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Weakness
CWE-170, CWE-20
Updated
2026-11-02
EUVDEUVD-2026-22158 2.9

jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.

Record
EUVD-2026-22158
CVSS 4.0
2.9 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
NVD 2.9

jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.

Record
CVE-2026-33948
CVSS 4.0
2.9 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-20, CWE-170
Updated
2026-11-02
OSVALPINE-CVE-2026-33948 5.3

jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.

Record
ALPINE-CVE-2026-33948
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVBELL-CVE-2026-33948 5.3
Record
BELL-CVE-2026-33948
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSV 2.9

jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input

jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.

Record
CVE-2026-33948
CVSS 4.0
2.9 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Weakness
CWE-170, CWE-20
Updated
2026-11-02
Show 18 moreShow less
OSVDEBIAN-CVE-2026-33948 5.3

jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.

Record
DEBIAN-CVE-2026-33948
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVOESA-2026-1981 8.2

jq security update

jq is a lightweight and flexible command-line JSON processor. you can use it to slice and filter and map and transform structured data. It is written in portable C, and it has zero runtime dependencies. it can mangle the data format that you have into the one that you want.

Security Fix(es):

jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5.(CVE-2026-32316)

jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(), and delpaths_sorted() in jq's src/jv_aux.c use unbounded recursion whose depth is controlled by the length of a caller-supplied path array, with no depth limit enforced. An attacker can supply a JSON document containing a flat array of ~65,000 integers (~200 KB) that, when used as a path argument by a trusted jq filter, exhausts the C call stack and crashes the process with a segmentation fault (SIGSEGV). This bypass works because the existing MAX_PARSING_DEPTH (10,000) limit only protects the JSON parser, not runtime path operations where arrays can be programmatically constructed to arbitrary lengths. The impact is denial of service (unrecoverable crash) affecting any application or service that processes untrusted JSON input through jq's setpath, getpath, or delpaths builtins. This issue has been addressed in commit fb59f1491058d58bdc3e8dd28f1773d1ac690a1f.(CVE-2026-33947)

jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.(CVE-2026-33948)

jq is a command-line JSON processor. In commits after 69785bf77f86e2ea1b4a20ca86775916889e91c9, the _strindices builtin in jq's src/builtin.c passes its arguments directly to jv_string_indexes() without verifying they are strings, and jv_string_indexes() in src/jv.c relies solely on assert() checks that are stripped in release builds compiled with -DNDEBUG. This allows an attacker to crash jq trivially with input like _strindices(0), and by crafting a numeric value whose IEEE-754 bit pattern maps to a chosen pointer, achieve a controlled pointer dereference and limited memory read/probe primitive. Any deployment that evaluates untrusted jq filters against a release build is vulnerable. This issue has been…

Record
OESA-2026-1981
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:8579 8.2

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:8579
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-33948 2.9

jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.

Record
UBUNTU-CVE-2026-33948
CVSS 4.0
2.9 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVAZL-82928 No score

CVE-2026-33948 affecting package jq for versions less than 1.7.1-5

jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.

Record
AZL-82928
Updated
2026-11-02
OSVCLSA-2026-1778142360 No score

jq: Fix of 2 CVEs

  • CVE-2026-33947: limit path depth in jv_setpath, jv_getpath, and jv_delpaths to prevent stack overflow from deep path arrays
  • CVE-2026-33948: remove strlen-based length calculation that truncated JSON input at embedded NUL bytes, preventing parser-differential attacks
Record
CLSA-2026-1778142360
Updated
2026-11-02
OSVCLSA-2026-1778143159 No score

jq: Fix of 2 CVEs

  • CVE-2026-33948: fix NUL truncation in JSON parser (validation bypass)
  • CVE-2026-33947: fix unbounded recursion stack overflow in jv_setpath/getpath/delpaths
Record
CLSA-2026-1778143159
Updated
2026-11-02
OSVMGASA-2026-0188 No score

Updated jq packages fix security vulnerabilities

An integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. (CVE-2024-23337) It was discovered that jq did not correctly handle certain string concatenations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-32316) It was discovered that jq did not correctly handle recursion in certain circumstances. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-33947) It was discovered that jq did not correctly handle improperly terminated strings. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-33948) It was discovered that jq did not correctly handle checking certain variable types. An attacker could possibly use this issue to cause a denial of service or leak sensitive information. (CVE-2026-39956) It was discovered that jq did not correctly handle certain string formatting. An attacker could possibly use this issue to leak sensitive information or cause a denial of service. (CVE-2026-39979) It was discovered that jq used a fixed seed for hash table operations. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-40164) A heap-buffer-overflow is present in function jv_string_vfmt in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 `void* p = malloc(sz); (CVE-2025-48060) Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed. (CVE-2026-41256) The ordinary module loader recurses without cycle detection when two otherwise valid modules include each other (CVE-2026-44777)

Record
MGASA-2026-0188
Updated
2026-11-02
OSVopenSUSE-SU-2026:10850-1 No score

jq-1.8.1-3.1 on GA media

These are all security issues fixed in the jq-1.8.1-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10850-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21248-1 No score

Security update for jq

This update for jq fixes the following issues:

  • CVE-2025-48060: improper handling of string data in jv_string_empty can lead to heap buffer overflow and a crash when processing crafted input (bsc#1244116).
  • CVE-2026-32316: integer overflow within the jvp_string_append() and jvp_string_copy_replace_bad functions can lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).
  • CVE-2026-33947: unbounded recursion in functions jv_setpath(), jv_getpath(), and delpaths_sorted() can lead to excessive resource consumption when processing crafted JSON input (bsc#1262069).
  • CVE-2026-39956: missing runtime type checks in _strindices and jv_string_indexes() can lead to a crash when evaluating untrusted jq filters against a release build (bsc#1262070).
  • CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in jv_parse_sized can lead to an out-of-bounds read when processing malformed JSON (bsc#1262071).
  • CVE-2026-40164: use of MurmurHash3 with a hardcoded seed allows pre-computation of key collisions and can lead to a denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).
  • CVE-2026-40612: recursion into nested arrays/objects with no depth limit in jv_contains can lead to a C stack exhaustion when processing crafted input (bsc#1265060).
  • CVE-2026-41256: truncation of top-level jq programs loaded with -f and can lead to the execution of unintended programs (bsc#1265061).
  • CVE-2026-41257: integer overflow in stack_reallocate can lead to memory corruption and DoS when processing jq bytecode (bsc#1265062).
  • CVE-2026-43894: signed integer overflow in the decNumberFromString D2U() macro can lead to an out-of-bounds memory write when processing large number literals (bsc#1265070).
  • CVE-2026-33948: improper handling of buffer sizes via strlen() instead of fgets() in CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).
Record
openSUSE-SU-2026:21248-1
Updated
2026-11-02
OSVSUSE-SU-2026:22545-1 No score

Security update for jq

This update for jq fixes the following issues:

  • CVE-2025-48060: improper handling of string data in jv_string_empty can lead to heap buffer overflow and a crash when processing crafted input (bsc#1244116).
  • CVE-2026-32316: integer overflow within the jvp_string_append() and jvp_string_copy_replace_bad functions can lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).
  • CVE-2026-33947: unbounded recursion in functions jv_setpath(), jv_getpath(), and delpaths_sorted() can lead to excessive resource consumption when processing crafted JSON input (bsc#1262069).
  • CVE-2026-39956: missing runtime type checks in _strindices and jv_string_indexes() can lead to a crash when evaluating untrusted jq filters against a release build (bsc#1262070).
  • CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in jv_parse_sized can lead to an out-of-bounds read when processing malformed JSON (bsc#1262071).
  • CVE-2026-40164: use of MurmurHash3 with a hardcoded seed allows pre-computation of key collisions and can lead to a denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).
  • CVE-2026-40612: recursion into nested arrays/objects with no depth limit in jv_contains can lead to a C stack exhaustion when processing crafted input (bsc#1265060).
  • CVE-2026-41256: truncation of top-level jq programs loaded with -f and can lead to the execution of unintended programs (bsc#1265061).
  • CVE-2026-41257: integer overflow in stack_reallocate can lead to memory corruption and DoS when processing jq bytecode (bsc#1265062).
  • CVE-2026-43894: signed integer overflow in the decNumberFromString D2U() macro can lead to an out-of-bounds memory write when processing large number literals (bsc#1265070).
  • CVE-2026-33948: improper handling of buffer sizes via strlen() instead of fgets() in CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).
Record
SUSE-SU-2026:22545-1
Updated
2026-11-02
OSVSUSE-SU-2026:22566-1 No score

Security update for jq

This update for jq fixes the following issues:

  • CVE-2025-48060: improper handling of string data in jv_string_empty can lead to heap buffer overflow and a crash when processing crafted input (bsc#1244116).
  • CVE-2026-32316: integer overflow within the jvp_string_append() and jvp_string_copy_replace_bad functions can lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).
  • CVE-2026-33947: unbounded recursion in functions jv_setpath(), jv_getpath(), and delpaths_sorted() can lead to excessive resource consumption when processing crafted JSON input (bsc#1262069).
  • CVE-2026-39956: missing runtime type checks in _strindices and jv_string_indexes() can lead to a crash when evaluating untrusted jq filters against a release build (bsc#1262070).
  • CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in jv_parse_sized can lead to an out-of-bounds read when processing malformed JSON (bsc#1262071).
  • CVE-2026-40164: use of MurmurHash3 with a hardcoded seed allows pre-computation of key collisions and can lead to a denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).
  • CVE-2026-40612: recursion into nested arrays/objects with no depth limit in jv_contains can lead to a C stack exhaustion when processing crafted input (bsc#1265060).
  • CVE-2026-41256: truncation of top-level jq programs loaded with -f and can lead to the execution of unintended programs (bsc#1265061).
  • CVE-2026-41257: integer overflow in stack_reallocate can lead to memory corruption and DoS when processing jq bytecode (bsc#1265062).
  • CVE-2026-43894: signed integer overflow in the decNumberFromString D2U() macro can lead to an out-of-bounds memory write when processing large number literals (bsc#1265070).
  • CVE-2026-33948: improper handling of buffer sizes via strlen() instead of fgets() in CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).
Record
SUSE-SU-2026:22566-1
Updated
2026-11-02
OSVSUSE-SU-2026:22664-1 No score

Security update for jq

This update for jq fixes the following issues:

  • CVE-2026-32316: integer overflow within the jvp_string_append() and jvp_string_copy_replace_bad functions can lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).
  • CVE-2026-33947: unbounded recursion in functions jv_setpath(), jv_getpath(), and delpaths_sorted() can lead to excessive resource consumption when processing crafted JSON input (bsc#1262069).
  • CVE-2026-39956: missing runtime type checks in _strindices and jv_string_indexes() can lead to a crash when evaluating untrusted jq filters against a release build (bsc#1262070).
  • CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in jv_parse_sized can lead to an out-of-bounds read when processing malformed JSON (bsc#1262071).
  • CVE-2026-40164: use of MurmurHash3 with a hardcoded seed allows pre-computation of key collisions and can lead to a denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).
  • CVE-2026-40612: recursion into nested arrays/objects with no depth limit in jv_contains can lead to a C stack exhaustion when processing crafted input (bsc#1265060).
  • CVE-2026-41256: truncation of top-level jq programs loaded with -f and can lead to the execution of unintended programs (bsc#1265061).
  • CVE-2026-41257: integer overflow in stack_reallocate can lead to memory corruption and DoS when processing jq bytecode (bsc#1265062).
  • CVE-2026-43894: signed integer overflow in the decNumberFromString D2U() macro can lead to an out-of-bounds memory write when processing large number literals (bsc#1265070).
  • CVE-2026-33948: improper handling of buffer sizes via strlen() instead of fgets() in CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).
Record
SUSE-SU-2026:22664-1
Updated
2026-11-02
OSVSUSE-SU-2026:22705-1 No score

Security update for jq

This update for jq fixes the following issues

Security issues fixed:

  • CVE-2025-9403: reacheable assertion in run_jq_tests can lead to program termination when processing malformed JSON input containing invalid Unicode escape sequences (bsc#1248600).
  • CVE-2026-32316: integer overflow within the jvp_string_append() and jvp_string_copy_replace_bad functions can lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).
  • CVE-2026-33947: unbounded recursion in functions jv_setpath(), jv_getpath(), and delpaths_sorted() can lead to excessive resource consumption when processing crafted JSON input (bsc#1262069).
  • CVE-2026-33948: improper handling of buffer sizes via strlen() instead of fgets() in CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).
  • CVE-2026-39956: missing runtime type checks in _strindices and jv_string_indexes() can lead to a crash when evaluating untrusted jq filters against a release build (bsc#1262070).
  • CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in jv_parse_sized can lead to an out-of-bounds read when processing malformed JSON (bsc#1262071).
  • CVE-2026-40164: use of MurmurHash3 with a hardcoded seed allows pre-computation of key collisions and can lead to a denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).

Other updates and bugfixes:

  • spec: add --enable-pthread-tls to configure invocation.
Record
SUSE-SU-2026:22705-1
Updated
2026-11-02
OSVSUSE-SU-2026:2283-1 No score

Security update for jq

This update for jq fixes the following issue

  • CVE-2026-33948: CLI input parsing may allow validation bypass via embedded NUL bytes (bsc#1262043)
Record
SUSE-SU-2026:2283-1
Updated
2026-11-02
OSVSUSE-SU-2026:23873-1 No score

Security update for jq

This update for jq fixes the following issues:

Security issues fixed:

  • CVE-2015-8863: heap buffer overflow in tokenadd() function (bsc#976992).
  • CVE-2023-50246: improper memory handling can lead to a heap buffer overflow in decNumberToString (bsc#1218034).
  • CVE-2023-50268: stack-based buffer overflow in builds using decNumber (bsc#1218038).
  • CVE-2024-53427: stack-buffer-overflow in the decNumberCopy function in decNumber.c (bsc#1238078).
  • CVE-2025-9403: reachable assertion in run_jq_tests() (bsc#1248600).
  • CVE-2026-32316: denial of Service or potential arbitrary code execution due to integer overflow and heap-based buffer overflow (bsc#1262044).
  • CVE-2026-33948: CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).
  • CVE-2026-40164: predictable hash collisions can lead to a denial of service (bsc#1262072).
  • CVE-2026-40612: jv_contains recurses into nested arrays/objects with no depth limit and can cause a stack overflow (bsc#1265060).
  • CVE-2026-41256: embedded NUL truncates top-level jq programs loaded with -f and can lead to execution of unintended programs (bsc#1265061).
  • CVE-2026-41257: integer overflow in stack_reallocate can lead to memory corruption and DoS (bsc#1265062).
  • CVE-2026-43894: signed integer overflow in decNumber can lead to out-of-bounds memory write (bsc#1265070).
  • CVE-2026-43895: embedded NUL bytes in import paths can lead to policy bypass and sensitive information disclosure (bsc#1265071).
  • CVE-2026-43896: unbounded recursion in jv_object_merge_recursive() can lead to C stack exhaustion and a process crash (bsc#1265075).
  • CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules include each other can lead to stack exhaustion and process crash (bsc#1265076).
  • CVE-2026-47770: stack overflow in deep structural equality (bsc#1269221).
  • CVE-2026-49839: --rawfile invalid-state reuse after String too long can lead to a heap buffer overflow (bsc#1269220).
  • CVE-2026-54679: integer overflow in jvp_string_append can lead to a buffer overrun on 32-bit systems (bsc#1269390).

Changes for jq:

Update to version 1.7.1:

  • Make the default background color more suitable for bright backgrounds.
  • Allow passing the inline jq script after --.
  • Fix possible uninitialised value dereference if jq_init() fails
  • Simplify paths/0 and paths/1.
  • Reject U+001F in string literals.
  • Remove unused nref accumulator in block_bind_library.
  • Remove a bunch of unused variables, and useless assignments.
  • main.c: Remove unused EXIT_STATUS_EXACT option.
  • Actually use the number correctly casted from double to int as index.
  • src/builtin.c: remove unnecessary jv_copy-s in type_error/type_error2.
  • Remove undefined behavior caught by LLVM 10 UBSAN.
  • Convert decnum to binary64 (double) instead of decimal64. This makes jq behave like the JSON specification suggests and more similar to other languages.
  • Fix memory leaks on invalid input for ltrimstr/1 and rtrimstr/1.
  • Fix memory leak on failed get for setpath/2.
  • Fix nan from json parsing also for nans with payload that start with 'n'.
  • Allow carriage return characters in comments.
  • Generate links in the man page.
  • Add extern C for C++.
  • Make object key color configurable using JQ_COLORS environment variable.
  • Change the default color of null to Bright Black.
  • Respect NO_COLOR environment variable to disable color output.
  • Improved --help output. Now mentions all options and nicer order.
  • Fix multiple issues of exit code using --exit-code/-e option.
  • Add --raw-output0 for NUL (zero byte) separated output.
  • Fix assert crash and validate JSON for --jsonarg.
  • Remove deprecated --argfile option.
  • Use decimal number literals to preserve precision. Comparison operations respects precision but arithmetic operations might truncate.
  • Adds new builtin pick(stream) to emit a projection of the input object or array.
  • Adds new builtin…
Record
SUSE-SU-2026:23873-1
Updated
2026-11-02
OSVSUSE-SU-2026:4275-1 No score

Security update for jq

This update for jq fixes the following issues:

Security issues fixed:

  • CVE-2015-8863: heap buffer overflow in tokenadd() function (bsc#976992).
  • CVE-2023-50246: improper memory handling can lead to a heap buffer overflow in decNumberToString (bsc#1218034).
  • CVE-2023-50268: stack-based buffer overflow in builds using decNumber (bsc#1218038).
  • CVE-2024-53427: stack-buffer-overflow in the decNumberCopy function in decNumber.c (bsc#1238078).
  • CVE-2025-9403: reachable assertion in run_jq_tests() (bsc#1248600).
  • CVE-2026-33948: CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).
  • CVE-2026-40164: predictable hash collisions can lead to a denial of service (bsc#1262072).
  • CVE-2026-40612: jv_contains recurses into nested arrays/objects with no depth limit and can cause a stack overflow (bsc#1265060).
  • CVE-2026-41256: embedded NUL truncates top-level jq programs loaded with -f and can lead to execution of unintended programs (bsc#1265061).
  • CVE-2026-41257: integer overflow in stack_reallocate can lead to memory corruption and DoS (bsc#1265062).
  • CVE-2026-43894: signed integer overflow in decNumber can lead to out-of-bounds memory write (bsc#1265070).
  • CVE-2026-43895: embedded NUL bytes in import paths can lead to policy bypass and sensitive information disclosure (bsc#1265071).
  • CVE-2026-43896: unbounded recursion in jv_object_merge_recursive() can lead to C stack exhaustion and a process crash (bsc#1265075).
  • CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules include each other can lead to stack exhaustion and process crash (bsc#1265076).
  • CVE-2026-47770: stack overflow in deep structural equality (bsc#1269221).
  • CVE-2026-49839: --rawfile invalid-state reuse after String too long can lead to a heap buffer overflow (bsc#1269220).
  • CVE-2026-54679: integer overflow in jvp_string_append can lead to a buffer overrun on 32-bit systems (bsc#1269390).

Changes for jq:

Update to version 1.7.1:

  • Make the default background color more suitable for bright backgrounds.
  • Allow passing the inline jq script after --.
  • Fix possible uninitialised value dereference if jq_init() fails
  • Simplify paths/0 and paths/1.
  • Reject U+001F in string literals.
  • Remove unused nref accumulator in block_bind_library.
  • Remove a bunch of unused variables, and useless assignments.
  • main.c: Remove unused EXIT_STATUS_EXACT option.
  • Actually use the number correctly casted from double to int as index.
  • src/builtin.c: remove unnecessary jv_copy-s in type_error/type_error2.
  • Remove undefined behavior caught by LLVM 10 UBSAN.
  • Convert decnum to binary64 (double) instead of decimal64. This makes jq behave like the JSON specification suggests and more similar to other languages.
  • Fix memory leaks on invalid input for ltrimstr/1 and rtrimstr/1.
  • Fix memory leak on failed get for setpath/2.
  • Fix nan from json parsing also for nans with payload that start with 'n'.
  • Allow carriage return characters in comments.
  • Generate links in the man page.
  • Add extern C for C++.
  • Make object key color configurable using JQ_COLORS environment variable.
  • Change the default color of null to Bright Black.
  • Respect NO_COLOR environment variable to disable color output.
  • Improved --help output. Now mentions all options and nicer order.
  • Fix multiple issues of exit code using --exit-code/-e option.
  • Add --raw-output0 for NUL (zero byte) separated output.
  • Fix assert crash and validate JSON for --jsonarg.
  • Remove deprecated --argfile option.
  • Use decimal number literals to preserve precision. Comparison operations respects precision but arithmetic operations might truncate.
  • Adds new builtin pick(stream) to emit a projection of the input object or array.
  • Adds new builtin debug(msgs) that works like debug but applies a filter on the input before writing to stderr.
  • Adds new builtin scan($re; $flags). Was documented…
Record
SUSE-SU-2026:4275-1
Updated
2026-11-02
OSVUSN-8202-1 No score

jq vulnerabilities

It was discovered that jq did not correctly handle certain string concatenations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue was addressed in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-32316)

It was discovered that jq did not correctly handle recursion in certain circumstances. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-33947)

It was discovered that jq did not correctly handle improperly terminated strings. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue was addressed in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-33948)

It was discovered that jq did not correctly handle checking certain variable types. An attacker could possibly use this issue to cause a denial of service or leak sensitive information. This issue was addressed in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-39956)

It was discovered that jq did not correctly handle certain string formatting. An attacker could possibly use this issue to leak sensitive information or cause a denial of service. (CVE-2026-39979)

It was discovered that jq used a fixed seed for hash table operations. An attacker could possibly use this issue to cause a denial of service. This issue was addressed in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-40164)

Record
USN-8202-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
jq
Alpine:v3.22
 before 1.8.2-r0
1.8.2-r0
jq
Alpine:v3.23
 before 1.8.2-r0
1.8.2-r0
jq
Alpine:v3.24
 before 1.8.2-r0
1.8.2-r0
jq
Azure Linux:3
 before 1.7.1-5
1.7.1-5
jq
Alpaquita:23
 1.6-r2 up to 1.8.1-r1
1.8.1-r1
jq
Alpaquita:25
 1.7.1-r0 up to 1.8.1-r2
1.8.1-r2
jq
Alpaquita:stream
 1.6-r1 up to 1.8.1-r1
1.8.1-r1
jq
TuxCare:AlmaLinux:9.2
 before 1.6-14.el9.tuxcare.els4
1.6-14.el9.tuxcare.els4
jq-devel
TuxCare:AlmaLinux:9.2
 before 1.6-14.el9.tuxcare.els4
1.6-14.el9.tuxcare.els4
jq
TuxCare:AlmaLinux:9.6
 before 1.6-17.el9_6.2.tuxcare.els2
1.6-17.el9_6.2.tuxcare.els2
Show 43 moreShow less
Affected packages
PackageAffectedFixed
jq-devel
TuxCare:AlmaLinux:9.6
 before 1.6-17.el9_6.2.tuxcare.els2
1.6-17.el9_6.2.tuxcare.els2
jq
Debian:12
 before 1.6-2.1+deb12u2, plus listed versions
1.6-2.11.6-2.1+deb12u1
1.6-2.1+deb12u2
jq
Debian:13
 before 1.7.1-6+deb13u2, plus listed versions
1.7.1-6+deb13u1
1.7.1-6+deb13u2
jq
Debian:14
 before 1.8.1-5, plus listed versions
1.8.0-11.8.1-11.8.1-21.8.1-31.8.1-4
1.8.1-5
jq
Mageia:9
 before 1.6-3.1.mga9
1.6-3.1.mga9
jq
openEuler:24.03-LTS
 before 1.8.0-3.oe2403sp3
1.8.0-3.oe2403sp3
jq
openEuler:24.03-LTS-SP1
 before 1.8.0-3.oe2403sp1
1.8.0-3.oe2403sp1
jq
openEuler:24.03-LTS-SP2
 before 1.8.0-3.oe2403sp2
1.8.0-3.oe2403sp2
jq
openEuler:24.03-LTS-SP3
 before 1.8.0-3.oe2403sp3
1.8.0-3.oe2403sp3
jq
openEuler:20.03-LTS-SP4
 before 1.8.0-3.oe2003sp4
1.8.0-3.oe2003sp4
jq
openEuler:22.03-LTS-SP4
 before 1.8.0-3.oe2203sp4
1.8.0-3.oe2203sp4
jq
Red Hat:hummingbird:1
 before 0:1.8.1-3.hum1
0:1.8.1-3.hum1
jq-devel
Red Hat:hummingbird:1
 before 0:1.8.1-3.hum1
0:1.8.1-3.hum1
jq
SUSE:Linux Micro 6.2
 before 1.7.1-160000.3.1
1.7.1-160000.3.1
jq
SUSE:Linux Enterprise Server 16.0
 before 1.7.1-160000.3.1
1.7.1-160000.3.1
jq
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 1.7.1-160000.3.1
1.7.1-160000.3.1
jq
SUSE:Linux Micro 6.1
 before 1.7.1-slfo.1.1_3.1
1.7.1-slfo.1.1_3.1
jq
SUSE:Linux Micro 6.0
 before 1.6-6.1
1.6-6.1
jq
SUSE:Linux Micro 6.0
 before 1.7.1-1.1
1.7.1-1.1
jq
SUSE:Linux Enterprise Micro 5.3
 before 1.7.1-150000.3.25.1
1.7.1-150000.3.25.1
jq
SUSE:Linux Enterprise Micro 5.4
 before 1.7.1-150000.3.25.1
1.7.1-150000.3.25.1
jq
SUSE:Linux Enterprise Micro 5.5
 before 1.7.1-150000.3.25.1
1.7.1-150000.3.25.1
jq
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 1.7.1-150000.3.25.1
1.7.1-150000.3.25.1
jq
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 1.7.1-150000.3.25.1
1.7.1-150000.3.25.1
jq
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 1.7.1-150000.3.25.1
1.7.1-150000.3.25.1
jq
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 1.7.1-150000.3.25.1
1.7.1-150000.3.25.1
jq
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 1.7.1-150000.3.25.1
1.7.1-150000.3.25.1
jq
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 1.7.1-150000.3.25.1
1.7.1-150000.3.25.1
jq
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 1.7.1-150000.3.25.1
1.7.1-150000.3.25.1
jq
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 1.7.1-150000.3.25.1
1.7.1-150000.3.25.1
jq
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 1.7.1-150000.3.25.1
1.7.1-150000.3.25.1
jq
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 1.7.1-150000.3.25.1
1.7.1-150000.3.25.1
jq
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 1.7.1-150000.3.25.1
1.7.1-150000.3.25.1
jq
Ubuntu:Pro:16.04:LTS
 before 1.5+dfsg-1ubuntu0.1+esm4, plus listed versions
1.4-2.11.5+dfsg-11.5+dfsg-1ubuntu0.11.5+dfsg-1ubuntu0.1+esm21.5+dfsg-1ubuntu0.1+esm3
1.5+dfsg-1ubuntu0.1+esm4
jq
Ubuntu:Pro:18.04:LTS
 before 1.5+dfsg-2ubuntu0.1~esm2, plus listed versions
1.5+dfsg-21.5+dfsg-2ubuntu0.1~esm1
1.5+dfsg-2ubuntu0.1~esm2
jq
Ubuntu:Pro:20.04:LTS
 before 1.6-1ubuntu0.20.04.1+esm2, plus listed versions
1.5+dfsg-2build11.6-11.6-1ubuntu0.20.04.11.6-1ubuntu0.20.04.1+esm1
1.6-1ubuntu0.20.04.1+esm2
jq
Ubuntu:22.04:LTS
 before 1.6-2.1ubuntu3.2, plus listed versions
1.6-2.1ubuntu21.6-2.1ubuntu31.6-2.1ubuntu3.1
1.6-2.1ubuntu3.2
jq
Ubuntu:24.04:LTS
 before 1.7.1-3ubuntu0.24.04.2, plus listed versions
1.6-31.7-11.7.1-21.7.1-31.7.1-3build11.7.1-3ubuntu0.24.04.1
1.7.1-3ubuntu0.24.04.2
jq
Ubuntu:25.10
 before 1.8.1-3ubuntu1.1, plus listed versions
1.7.1-3ubuntu11.7.1-6ubuntu11.8.1-3ubuntu1
1.8.1-3ubuntu1.1
jq
Ubuntu:26.04:LTS
 before 1.8.1-4ubuntu2, plus listed versions
1.8.1-3ubuntu11.8.1-4ubuntu1
1.8.1-4ubuntu2
jq
Ubuntu:Pro:14.04:LTS
 before 1.3-1.1ubuntu1.1+esm4, plus listed versions
1.2-81.3-11.3-1.1ubuntu11.3-1.1ubuntu1.11.3-1.1ubuntu1.1+esm3
1.3-1.1ubuntu1.1+esm4
jq
openSUSE:Tumbleweed
 before 1.8.1-3.1
1.8.1-3.1
jq
openSUSE:Leap 16.0
 before 1.7.1-160000.3.1
1.7.1-160000.3.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-33948 is a low vulnerability (CVSS 2.9) in Jqlang Jq, published April 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in jq 1.8.2-r0.

References

Show 105 moreShow less
This page doesn't list everything

Left out here: the rest of 3 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open