{"id":"CVE-2023-50246","aliases":["ALPINE-CVE-2023-50246","BELL-CVE-2023-50246","DEBIAN-CVE-2023-50246","EUVD-2023-55064","GHSA-686w-5m7m-54vc","SUSE-SU-2026:23873-1","SUSE-SU-2026:4275-1","UBUNTU-CVE-2023-50246","openSUSE-SU-2024:13521-1"],"status":"published","title":"jq has heap-buffer-overflow vulnerability in the function decToString in decNumber.c","description":"jq is a command-line JSON processor. Version 1.7 is vulnerable to heap-based buffer overflow. Version 1.7.1 contains a patch for this issue.","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00508,"percentile":0.43706,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120","CWE-122","CWE-787"],"published":"2023-12-13T20:43:50Z","modified":"2026-10-28T10:40:30Z","fixes":[{"ecosystem":"Alpine:v3.19","package":"jq","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"jq","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"jq","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"jq","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"jq","fixed_in":["1.7.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jq","fixed_in":["1.7.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jq","fixed_in":["1.7.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7-r0"},{"fixed":"1.7.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-1.1"}]}],"bundled":2}],"products":[{"vendor":"jqlang","product":"jq"}],"references":[{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-686w-5m7m-54vc","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","report"]},{"url":"https://github.com/jqlang/jq/commit/71c2ab509a8628dbbad4bc7b3f98a64aa90d3297","tags":["x_refsource_MISC","x_transferred","Patch","fix","report"]},{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64574","tags":["x_refsource_MISC","x_transferred","Mailing List","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2023/12/15/10","tags":["x_transferred","Mailing List","Patch","Third Party Advisory","web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-50246","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-50246","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50246.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50246","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-50246","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623873-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215737","tags":["report"]},{"url":"https://bugzilla.suse.com/1218034","tags":["report"]},{"url":"https://bugzilla.suse.com/1218038","tags":["report"]},{"url":"https://bugzilla.suse.com/1238078","tags":["report"]},{"url":"https://bugzilla.suse.com/1248600","tags":["report"]},{"url":"https://bugzilla.suse.com/1262043","tags":["report"]},{"url":"https://bugzilla.suse.com/1262044","tags":["report"]},{"url":"https://bugzilla.suse.com/1262072","tags":["report"]},{"url":"https://bugzilla.suse.com/1265060","tags":["report"]},{"url":"https://bugzilla.suse.com/1265061","tags":["report"]},{"url":"https://bugzilla.suse.com/1265062","tags":["report"]},{"url":"https://bugzilla.suse.com/1265070","tags":["report"]},{"url":"https://bugzilla.suse.com/1265071","tags":["report"]},{"url":"https://bugzilla.suse.com/1265075","tags":["report"]},{"url":"https://bugzilla.suse.com/1265076","tags":["report"]},{"url":"https://bugzilla.suse.com/1269220","tags":["report"]},{"url":"https://bugzilla.suse.com/1269221","tags":["report"]},{"url":"https://bugzilla.suse.com/1269390","tags":["report"]},{"url":"https://bugzilla.suse.com/976992","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40612","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54679","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264275-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-50246","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-50246","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-50246","title":"jq has heap-buffer-overflow vulnerability in the function decToString in decNumber.c","description":"jq is a command-line JSON processor. Version 1.7 is vulnerable to heap-based buffer overflow. Version 1.7.1 contains a patch for this issue.","status":"published","published":"2023-12-13T20:43:50.862Z","modified":"2025-02-13T17:19:01.17Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-122","CWE-120"],"updated_at":"2026-11-02T14:35:34.55015Z"}],"euvd":[{"id":"EUVD-2023-55064","description":"jq is a command-line JSON processor. Version 1.7 is vulnerable to heap-based buffer overflow. Version 1.7.1 contains a patch for this issue.","status":"published","published":"2023-12-13T20:43:50Z","modified":"2025-02-13T17:19:01Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:03:48.029386Z"}],"nvd":[{"id":"CVE-2023-50246","description":"jq is a command-line JSON processor. Version 1.7 is vulnerable to heap-based buffer overflow. Version 1.7.1 contains a patch for this issue.","status":"published","published":"2023-12-13T21:15:08.45Z","modified":"2026-06-17T06:39:22.477Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-120","CWE-122","CWE-787"],"updated_at":"2026-11-02T14:08:54.696438Z"}],"osv":[{"id":"ALPINE-CVE-2023-50246","description":"jq is a command-line JSON processor. Version 1.7 is vulnerable to heap-based buffer overflow. Version 1.7.1 contains a patch for this issue.","status":"published","published":"2023-12-13T21:15:08.45Z","modified":"2026-10-26T17:17:58.658182079Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2023-50246","status":"published","published":"2023-12-13T21:15:00Z","modified":"2026-01-26T09:36:46.856465Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:18.192656Z"},{"id":"CVE-2023-50246","title":"jq has heap-buffer-overflow vulnerability in the function decToString in decNumber.c","description":"jq is a command-line JSON processor. Version 1.7 is vulnerable to heap-based buffer overflow. Version 1.7.1 contains a patch for this issue.","status":"published","published":"2023-12-13T20:43:50.862Z","modified":"2026-10-28T10:40:30.499699336Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-120","CWE-122"],"updated_at":"2026-11-02T15:44:34.72355Z"},{"id":"DEBIAN-CVE-2023-50246","description":"jq is a command-line JSON processor. Version 1.7 is vulnerable to heap-based buffer overflow. Version 1.7.1 contains a patch for this issue.","status":"published","published":"2023-12-13T21:15:08.45Z","modified":"2026-10-26T18:03:07.127135202Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:40.586408Z"},{"id":"UBUNTU-CVE-2023-50246","description":"jq is a command-line JSON processor. Version 1.7 is vulnerable to heap-based buffer overflow. Version 1.7.1 contains a patch for this issue.","status":"withdrawn","published":"2023-12-13T21:15:00Z","modified":"2025-07-16T07:46:28.659693Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"openSUSE-SU-2024:13521-1","title":"jq-1.7.1-1.1 on GA media","description":"These are all security issues fixed in the jq-1.7.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:58:33.677146Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2026:23873-1","title":"Security update for jq","description":"This update for jq fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2015-8863: heap buffer overflow in tokenadd() function (bsc#976992).\n- CVE-2023-50246: improper memory handling can lead to a heap buffer overflow in `decNumberToString` (bsc#1218034).\n- CVE-2023-50268: stack-based buffer overflow in builds using decNumber (bsc#1218038).\n- CVE-2024-53427: stack-buffer-overflow in the decNumberCopy function in decNumber.c (bsc#1238078).\n- CVE-2025-9403: reachable assertion in run_jq_tests() (bsc#1248600).\n- CVE-2026-32316: denial of Service or potential arbitrary code execution due to integer overflow and heap-based buffer\n  overflow (bsc#1262044).\n- CVE-2026-33948: CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).\n- CVE-2026-40164: predictable hash collisions can lead to a denial of service (bsc#1262072).\n- CVE-2026-40612: jv_contains recurses into nested arrays/objects with no depth limit and can cause a stack overflow\n  (bsc#1265060).\n- CVE-2026-41256: embedded NUL truncates top-level jq programs loaded with -f and can lead to execution of unintended\n  programs (bsc#1265061).\n- CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS (bsc#1265062).\n- CVE-2026-43894: signed integer overflow in `decNumber` can lead to out-of-bounds memory write (bsc#1265070).\n- CVE-2026-43895: embedded NUL bytes in import paths can lead to policy bypass and sensitive information disclosure\n  (bsc#1265071).\n- CVE-2026-43896: unbounded recursion in `jv_object_merge_recursive()` can lead to C stack exhaustion and a process\n  crash (bsc#1265075).\n- CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules `include` each other can lead\n  to stack exhaustion and process crash (bsc#1265076).\n- CVE-2026-47770: stack overflow in deep structural equality (bsc#1269221).\n- CVE-2026-49839: `--rawfile` invalid-state reuse after `String too long` can lead to a heap buffer overflow\n  (bsc#1269220).\n- CVE-2026-54679: integer overflow in `jvp_string_append` can lead to a buffer overrun on 32-bit systems (bsc#1269390).\n\nChanges for jq:\n\nUpdate to version 1.7.1:\n\n * Make the default background color more suitable for bright\n backgrounds.\n * Allow passing the inline jq script after --.\n * Fix possible uninitialised value dereference if jq_init() fails\n * Simplify paths/0 and paths/1.\n * Reject U+001F in string literals.\n * Remove unused nref accumulator in block_bind_library.\n * Remove a bunch of unused variables, and useless assignments.\n * main.c: Remove unused EXIT_STATUS_EXACT option.\n * Actually use the number correctly casted from double to int as\n index.\n * src/builtin.c: remove unnecessary jv_copy-s in\n type_error/type_error2.\n * Remove undefined behavior caught by LLVM 10 UBSAN.\n * Convert decnum to binary64 (double) instead of decimal64.\n This makes jq behave like the JSON specification suggests and\n more similar to other languages.\n * Fix memory leaks on invalid input for ltrimstr/1 and\n rtrimstr/1.\n * Fix memory leak on failed get for setpath/2.\n * Fix nan from json parsing also for nans with payload that\n start with 'n'.\n * Allow carriage return characters in comments.\n * Generate links in the man page.\n * Add extern C for C++.\n * Make object key color configurable using JQ_COLORS environment\n variable.\n * Change the default color of null to Bright Black.\n * Respect NO_COLOR environment variable to disable color output.\n * Improved --help output. Now mentions all options and nicer\n order.\n * Fix multiple issues of exit code using --exit-code/-e option.\n * Add --raw-output0 for NUL (zero byte) separated output.\n * Fix assert crash and validate JSON for --jsonarg.\n * Remove deprecated --argfile option.\n * Use decimal number literals to preserve precision. Comparison\n operations respects precision but arithmetic operations might\n truncate.\n * Adds new builtin pick(stream) to emit a projection of the\n input object or array.\n * Adds new builtin debug(msgs) that works like debug but applies\n a filter on the input before writing to stderr.\n * Adds new builtin scan($re; $flags). Was documented but not\n implemented.\n * Adds new builtin abs to get absolute value. This potentially\n allows the literal value of numbers to be preserved as length\n and fabs convert to float.\n * Allow if without else-branch. When skipped the else-branch\n will be . (identity).\n * Allow use of $binding as key in object literals.\n * Allow dot between chained indexes when using .[\"index\"]\n * Allow dot for chained value iterator .[], .[]?\n * Fix try/catch catches more than it should.\n * Speed up and refactor some builtins, also remove\n scalars_or_empty/0.\n * Now halt and halt_error exit immediately instead of continuing\n to the next input.\n * Fix issue converting string to number after previous convert\n error.\n * Fix issue representing large numbers on some platforms causing\n invalid JSON output.\n * Fix deletion using assigning empty against arrays.\n * Allow keywords to be used as binding name in more places.\n * Allow using nan as NaN in JSON.\n * Expose a module's function names in modulemeta.\n * Fix contains/1 to handle strings with NUL.\n * Fix stderr/0 to output raw text without any decoration.\n * Fix nth/2 to emit empty on index out of range.\n * Fix implode to not assert and instead replace invalid unicode\n codepoints.\n * Fix indices/1 and rindex/1 in case of overlapping matches in\n strings.\n * Fix sub/3 to resolve issues involving global search-and-replace\n (gsub) operations.\n * Fix empty regular expression matches.\n * Fix overflow exception of the modulo operator.\n * Fix string multiplication by 0 (and less than 1) to emit empty\n string.\n * Fix segfault when using libjq and threads.\n * Fix constant folding of division and reminder with zero\n divisor.\n * Fix error/0, error/1 to throw null error.\n * Simpler and faster transpose.\n * Simple and efficient implementation of walk/1.\n * Remove deprecated filters leaf_paths, recurse_down.\n","status":"published","published":"2026-09-17T08:05:35Z","modified":"2026-09-28T18:23:12.243926519Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:4275-1","title":"Security update for jq","description":"This update for jq fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2015-8863: heap buffer overflow in tokenadd() function (bsc#976992).\n- CVE-2023-50246: improper memory handling can lead to a heap buffer overflow in `decNumberToString` (bsc#1218034).\n- CVE-2023-50268: stack-based buffer overflow in builds using decNumber (bsc#1218038).\n- CVE-2024-53427: stack-buffer-overflow in the decNumberCopy function in decNumber.c (bsc#1238078).\n- CVE-2025-9403: reachable assertion in run_jq_tests() (bsc#1248600).\n- CVE-2026-33948: CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).\n- CVE-2026-40164: predictable hash collisions can lead to a denial of service (bsc#1262072).\n- CVE-2026-40612: jv_contains recurses into nested arrays/objects with no depth limit and can cause a stack overflow\n  (bsc#1265060).\n- CVE-2026-41256: embedded NUL truncates top-level jq programs loaded with -f and can lead to execution of unintended\n  programs (bsc#1265061).\n- CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS (bsc#1265062).\n- CVE-2026-43894: signed integer overflow in `decNumber` can lead to out-of-bounds memory write (bsc#1265070).\n- CVE-2026-43895: embedded NUL bytes in import paths can lead to policy bypass and sensitive information disclosure\n  (bsc#1265071).\n- CVE-2026-43896: unbounded recursion in `jv_object_merge_recursive()` can lead to C stack exhaustion and a process\n  crash (bsc#1265075).\n- CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules `include` each other can lead\n  to stack exhaustion and process crash (bsc#1265076).\n- CVE-2026-47770: stack overflow in deep structural equality (bsc#1269221).\n- CVE-2026-49839: `--rawfile` invalid-state reuse after `String too long` can lead to a heap buffer overflow\n  (bsc#1269220).\n- CVE-2026-54679: integer overflow in `jvp_string_append` can lead to a buffer overrun on 32-bit systems (bsc#1269390).\n\nChanges for jq:\n\nUpdate to version 1.7.1:\n\n * Make the default background color more suitable for bright\n backgrounds.\n * Allow passing the inline jq script after --.\n * Fix possible uninitialised value dereference if jq_init() fails\n * Simplify paths/0 and paths/1.\n * Reject U+001F in string literals.\n * Remove unused nref accumulator in block_bind_library.\n * Remove a bunch of unused variables, and useless assignments.\n * main.c: Remove unused EXIT_STATUS_EXACT option.\n * Actually use the number correctly casted from double to int as\n index.\n * src/builtin.c: remove unnecessary jv_copy-s in\n type_error/type_error2.\n * Remove undefined behavior caught by LLVM 10 UBSAN.\n * Convert decnum to binary64 (double) instead of decimal64.\n This makes jq behave like the JSON specification suggests and\n more similar to other languages.\n * Fix memory leaks on invalid input for ltrimstr/1 and\n rtrimstr/1.\n * Fix memory leak on failed get for setpath/2.\n * Fix nan from json parsing also for nans with payload that\n start with 'n'.\n * Allow carriage return characters in comments.\n * Generate links in the man page.\n * Add extern C for C++.\n * Make object key color configurable using JQ_COLORS environment\n variable.\n * Change the default color of null to Bright Black.\n * Respect NO_COLOR environment variable to disable color output.\n * Improved --help output. Now mentions all options and nicer\n order.\n * Fix multiple issues of exit code using --exit-code/-e option.\n * Add --raw-output0 for NUL (zero byte) separated output.\n * Fix assert crash and validate JSON for --jsonarg.\n * Remove deprecated --argfile option.\n * Use decimal number literals to preserve precision. Comparison\n operations respects precision but arithmetic operations might\n truncate.\n * Adds new builtin pick(stream) to emit a projection of the\n input object or array.\n * Adds new builtin debug(msgs) that works like debug but applies\n a filter on the input before writing to stderr.\n * Adds new builtin scan($re; $flags). Was documented but not\n implemented.\n * Adds new builtin abs to get absolute value. This potentially\n allows the literal value of numbers to be preserved as length\n and fabs convert to float.\n * Allow if without else-branch. When skipped the else-branch\n will be . (identity).\n * Allow use of $binding as key in object literals.\n * Allow dot between chained indexes when using .['index']\n * Allow dot for chained value iterator .[], .[]?\n * Fix try/catch catches more than it should.\n * Speed up and refactor some builtins, also remove\n scalars_or_empty/0.\n * Now halt and halt_error exit immediately instead of continuing\n to the next input.\n * Fix issue converting string to number after previous convert\n error.\n * Fix issue representing large numbers on some platforms causing\n invalid JSON output.\n * Fix deletion using assigning empty against arrays.\n * Allow keywords to be used as binding name in more places.\n * Allow using nan as NaN in JSON.\n * Expose a module's function names in modulemeta.\n * Fix contains/1 to handle strings with NUL.\n * Fix stderr/0 to output raw text without any decoration.\n * Fix nth/2 to emit empty on index out of range.\n * Fix implode to not assert and instead replace invalid unicode\n codepoints.\n * Fix indices/1 and rindex/1 in case of overlapping matches in\n strings.\n * Fix sub/3 to resolve issues involving global search-and-replace\n (gsub) operations.\n * Fix empty regular expression matches.\n * Fix overflow exception of the modulo operator.\n * Fix string multiplication by 0 (and less than 1) to emit empty\n string.\n * Fix segfault when using libjq and threads.\n * Fix constant folding of division and reminder with zero\n divisor.\n * Fix error/0, error/1 to throw null error.\n * Simpler and faster transpose.\n * Simple and efficient implementation of walk/1.\n * Remove deprecated filters leaf_paths, recurse_down.\n","status":"published","published":"2026-09-21T07:33:03Z","modified":"2026-09-21T17:15:07.382382398Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}