{"id":"CVE-2024-23337","aliases":["ALPINE-CVE-2024-23337","ALSA-2025:10585","ALSA-2025:10618","AZL-61967","AZL-61977","BELL-CVE-2024-23337","CLSA-2026-1776354546","DEBIAN-CVE-2024-23337","EUVD-2024-20848","GHSA-2q6r-344g-cx46","MGASA-2026-0188","OESA-2025-1809","RHSA-2025:10585","RHSA-2025:10613","RHSA-2025:10615","RHSA-2025:10616","RHSA-2025:10618","RHSA-2025:10619","RHSA-2025:10620","RHSA-2025:10621","RHSA-2025:10622","RHSA-2025:12882","RLSA-2025:10585","RLSA-2025:10618","RLSA-2025:12882","ROOT-OS-DEBIAN-12-CVE-2024-23337","SUSE-SU-2025:02384-1","SUSE-SU-2025:20506-1","SUSE-SU-2025:20591-1","UBUNTU-CVE-2024-23337","USN-7657-1","USN-7657-2","openSUSE-SU-2025:15233-1"],"status":"published","title":"jq has signed integer overflow in jv.c:jvp_array_write","description":"jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0046,"percentile":0.40281,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2025-05-21T14:34:51Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"jq","fixed_in":["1.8.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"jq","fixed_in":["1.8.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"jq","fixed_in":["1.8.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"jq","fixed_in":["1.6-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"jq","fixed_in":["1.7.1-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"jq","fixed_in":["1.6-r3"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"jq","fixed_in":["1.8.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"jq","fixed_in":["1.8.0-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"jq","fixed_in":["1.6-14.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"jq-devel","fixed_in":["1.6-14.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jq","fixed_in":["1.7.1-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jq","fixed_in":["1.7.1-6"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"jq","fixed_in":["1.6-2.1+deb12u3.aikido.9"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-jq","fixed_in":["1.6-2.1+deb12u3.aikido.9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"jq","fixed_in":["1.6-150000.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"jq","fixed_in":["1.6-150000.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"jq","fixed_in":["1.6-150000.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"jq","fixed_in":["1.6-150000.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jq","fixed_in":["1.6-150000.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"jq","fixed_in":["1.6-150000.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"jq","fixed_in":["1.6-150000.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"jq","fixed_in":["1.6-150000.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"jq","fixed_in":["1.6-4.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jq","fixed_in":["1.5+dfsg-1ubuntu0.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"jq","fixed_in":["1.5+dfsg-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"jq","fixed_in":["1.6-1ubuntu0.20.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"jq","fixed_in":["1.6-2.1ubuntu3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"jq","fixed_in":["1.7.1-3ubuntu0.24.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-17.el9_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"jq-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-17.el9_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-11.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jq-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-11.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:2","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6-r2"},{"fixed":"1.6-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.1-r0"},{"fixed":"1.8.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6-r2"},{"fixed":"1.8.0-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-14.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"jq-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-14.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-2.1","1.6-2.1+deb12u1","1.6-2.1+deb12u2","1.6-2.1+deb12u3","1.6-3","1.7-1","1.7.1-1","1.7.1-2","1.7.1-3","1.7.1-4","1.7.1-5","1.7.1-6","1.8.0-1","1.8.1-1","1.8.1-2","1.8.1-3","1.8.1-4","1.8.1-5","1.8.1-6","1.8.1-7","1.8.1-8","1.8.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-6"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-6"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-3.1.mga9"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-2.oe2203sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-2.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-2.oe2403sp2"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-2.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-2.oe2403sp2"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-2.oe2003sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-17.el9_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"jq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-17.el9_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"jq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-17.el9_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"jq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-17.el9_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"jq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-17.el9_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"jq-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-17.el9_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-16.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"jq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-16.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"jq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-16.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"jq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-16.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"jq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-16.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"jq-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-16.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-15.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"jq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-15.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"jq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-15.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-12.el9_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"jq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-12.el9_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"jq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-12.el9_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-11.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-11.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-11.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"jq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-11.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"jq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-11.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"jq-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-11.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-6.el8_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"jq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-6.el8_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"jq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-6.el8_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-6.el8_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"jq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-6.el8_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"jq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-6.el8_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-3.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"jq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-3.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"jq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-3.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-3.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"jq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-3.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"jq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-3.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-3.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"jq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-3.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"jq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-3.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-3.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"jq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-3.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"jq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-3.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5-12.el8_4.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"jq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5-12.el8_4.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"jq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5-12.el8_4.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5-12.el8_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"jq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5-12.el8_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"jq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5-12.el8_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-8.el10_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"jq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-8.el10_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"jq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-8.el10_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"jq-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-8.el10_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-17.el9_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-11.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.1-8.el10_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Debian:12","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-2.1+deb12u3.aikido.9"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-2.1+deb12u3.aikido.9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-slfo.1.1_2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5+dfsg-1ubuntu0.1+esm3"}]}],"versions":["1.4-2.1","1.5+dfsg-1","1.5+dfsg-1ubuntu0.1","1.5+dfsg-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5+dfsg-2ubuntu0.1~esm1"}]}],"versions":["1.5+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-1ubuntu0.20.04.1+esm1"}]}],"versions":["1.5+dfsg-2build1","1.6-1","1.6-1ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-2.1ubuntu3.1"}]}],"versions":["1.6-2.1ubuntu2","1.6-2.1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-3ubuntu0.24.04.1"}]}],"versions":["1.6-3","1.7-1","1.7.1-2","1.7.1-3","1.7.1-3build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-2.1ubuntu3.1"}]}],"versions":["1.6-2.1ubuntu2","1.6-2.1ubuntu3"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-3ubuntu0.24.04.1"}]}],"versions":["1.6-3","1.7-1","1.7.1-2","1.7.1-3","1.7.1-3build1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5+dfsg-1ubuntu0.1+esm3"}]}],"versions":["1.4-2.1","1.5+dfsg-1","1.5+dfsg-1ubuntu0.1","1.5+dfsg-1ubuntu0.1+esm2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5+dfsg-2ubuntu0.1~esm1"}]}],"versions":["1.5+dfsg-2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-1ubuntu0.20.04.1+esm1"}]}],"versions":["1.5+dfsg-2build1","1.6-1","1.6-1ubuntu0.20.04.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-1.1"}]}],"bundled":3}],"products":[{"vendor":"jqlang","product":"jq"}],"references":[{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-2q6r-344g-cx46","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","article","report"]},{"url":"https://github.com/jqlang/jq/issues/3262","tags":["x_refsource_MISC","Exploit","Issue Tracking","report","article"]},{"url":"https://github.com/jqlang/jq/commit/de21386681c0df0104a99d9d09db23a9b2a78b1e","tags":["x_refsource_MISC","Patch","fix","article"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-23337","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10585","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23337","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-48060","tags":["report"]},{"url":"https://bugzilla.redhat.com/2367807","tags":["report"]},{"url":"https://bugzilla.redhat.com/2367842","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-10585.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10618","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-10618.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23337","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-23337","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1776354546.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23337.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-23337","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0188.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34443","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/04/15/8","tags":["web"]},{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-q3h9-m34w-h76f","tags":["advisory"]},{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p","tags":["advisory"]},{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-32cx-cvvh-2wj9","tags":["advisory"]},{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-xwrw-4f8h-rjvg","tags":["advisory"]},{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-6gc3-3g9p-xx28","tags":["advisory"]},{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-wwj8-gxm6-jc29","tags":["advisory"]},{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-gf4g-95wj-4q4r","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1809","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48060","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49014","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2367807","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2367842","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10585.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23337","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-48060","tags":["advisory"]},{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-p7rr-28xf-3m5w","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10613","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10613.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10615","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10615.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10616","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10616.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10618.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10619","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10619.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10620","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10620.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10621","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10621.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10622","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10622.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:12882","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_12882.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:10585","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:10618","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:12882","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502384-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243450","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23337","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520506-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520591-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1238078","tags":["report"]},{"url":"https://bugzilla.suse.com/1244116","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48060","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-23337","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7657-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7657-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-53427","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-48060","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49014","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-23337","title":"jq has signed integer overflow in jv.c:jvp_array_write","description":"jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.","status":"published","published":"2025-05-21T14:34:51.007Z","modified":"2025-05-21T14:57:18.378Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:34:05.444281Z"}],"euvd":[{"id":"EUVD-2024-20848","description":"jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.","status":"published","published":"2025-05-21T14:34:51Z","modified":"2025-05-21T14:57:18Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T20:32:41.46277Z"}],"nvd":[{"id":"CVE-2024-23337","description":"jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.","status":"published","published":"2025-05-21T15:16:03.92Z","modified":"2026-06-17T07:12:37.49Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:10:47.073504Z"}],"osv":[{"id":"ALPINE-CVE-2024-23337","description":"jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.","status":"published","published":"2025-05-21T15:16:03.92Z","modified":"2026-11-02T11:17:50.073897898Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2024-23337","status":"published","published":"2025-05-22T05:59:07.886378Z","modified":"2026-01-26T09:42:51.362833Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"CVE-2024-23337","title":"jq has signed integer overflow in jv.c:jvp_array_write","description":"jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.","status":"published","published":"2025-05-21T14:34:51.007Z","modified":"2026-10-28T10:40:06.820880684Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:44:38.577405Z"},{"id":"DEBIAN-CVE-2024-23337","description":"jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.","status":"published","published":"2025-05-21T15:16:03.92Z","modified":"2026-11-02T12:00:50.228457939Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"OESA-2025-1809","title":"jq security update","description":"jq is a lightweight and flexible command-line JSON processor. you can use it to slice and filter and map and transform structured data. It is written in portable C, and it has zero runtime dependencies. it can mangle the data format that you have into the one that you want.\r\n\r\nSecurity Fix(es):\n\njq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.(CVE-2024-23337)\n\njq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 `void* p = malloc(sz);`. As of time of publication, no patched versions are available.(CVE-2025-48060)\n\njq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_strflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known fix version exists at time of publication.(CVE-2025-49014)","status":"published","published":"2025-07-11T11:08:53Z","modified":"2026-08-18T01:18:45.833956208Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"RHSA-2025:10585","title":"Red Hat Security Advisory: jq security update","status":"published","published":"2025-07-09T10:05:04Z","modified":"2026-09-01T10:04:18Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:10613","title":"Red Hat Security Advisory: jq security update","status":"published","published":"2025-07-09T10:05:05Z","modified":"2026-09-01T10:04:19Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:10615","title":"Red Hat Security Advisory: jq security update","status":"published","published":"2025-07-09T10:05:06Z","modified":"2026-09-01T10:04:20Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:10616","title":"Red Hat Security Advisory: jq security update","status":"published","published":"2025-07-09T10:05:06Z","modified":"2026-09-01T10:04:20Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:10618","title":"Red Hat Security Advisory: jq security update","status":"published","published":"2025-07-09T10:05:07Z","modified":"2026-09-01T10:04:21Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:10619","title":"Red Hat Security Advisory: jq security update","status":"published","published":"2025-07-09T10:05:07Z","modified":"2026-09-01T10:04:21Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:10620","title":"Red Hat Security Advisory: jq security update","status":"published","published":"2025-07-09T10:05:07Z","modified":"2026-09-01T10:04:22Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:10621","title":"Red Hat Security Advisory: jq security update","status":"published","published":"2025-07-09T10:05:08Z","modified":"2026-09-01T10:04:23Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:10622","title":"Red Hat Security Advisory: jq security update","status":"published","published":"2025-07-09T10:05:08Z","modified":"2026-09-01T10:04:23Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:12882","title":"Red Hat Security Advisory: jq security update","status":"published","published":"2025-08-05T10:22:21Z","modified":"2026-09-01T10:05:20Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RLSA-2025:10585","title":"Moderate: jq security update","description":"jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text.\n\nSecurity Fix(es):\n\n* jq: jq has signed integer overflow in jv.c:jvp_array_write (CVE-2024-23337)\n\n* jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-04T00:11:48.040698Z","modified":"2025-10-07T17:40:37.091353Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2025:10618","title":"Moderate: jq security update","description":"jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text.\n\nSecurity Fix(es):\n\n* jq: jq has signed integer overflow in jv.c:jvp_array_write (CVE-2024-23337)\n\n* jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:38:41.630147Z","modified":"2025-07-29T15:00:27.715595Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2025:12882","title":"Moderate: jq security update","description":"jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text.\n\nSecurity Fix(es):\n\n* jq: jq has signed integer overflow in jv.c:jvp_array_write (CVE-2024-23337)\n\n* jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:57:04.772748Z","modified":"2025-10-08T17:12:51.395896Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2024-23337","title":"CVE-2024-23337 in jq - Patched by Root","description":"Root has patched CVE-2024-23337 in the jq package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-19T06:38:00Z","modified":"2026-10-19T07:15:05.126148248Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:30.70924Z"},{"id":"UBUNTU-CVE-2024-23337","description":"jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.","status":"published","published":"2025-05-21T15:16:00Z","modified":"2026-04-22T14:35:30.271242Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:42.68848Z"},{"id":"ALSA-2025:10585","title":"Moderate: jq security update","description":"jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text.  \n\nSecurity Fix(es):  \n\n  * jq: jq has signed integer overflow in jv.c:jvp_array_write (CVE-2024-23337)\n  * jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-07-08T00:00:00Z","modified":"2026-10-29T11:31:55.101763713Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2025:10618","title":"Moderate: jq security update","description":"jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text.  \n\nSecurity Fix(es):  \n\n  * jq: jq has signed integer overflow in jv.c:jvp_array_write (CVE-2024-23337)\n  * jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-07-08T00:00:00Z","modified":"2026-10-29T11:02:12.704575838Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"AZL-61967","title":"CVE-2024-23337 affecting package jq for versions less than 1.6-3","description":"jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.","status":"published","published":"2025-05-21T15:16:03Z","modified":"2026-04-21T04:31:53.593177Z","updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"AZL-61977","title":"CVE-2024-23337 affecting package jq for versions less than 1.7.1-3","description":"jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.","status":"published","published":"2025-05-21T15:16:03Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.518778Z"},{"id":"CLSA-2026-1776354546","title":"jq: Fix of CVE-2024-23337","description":"- CVE-2024-23337: fix signed integer overflow in jvp_array_write and\n  jvp_object_rehash that could lead to SEGV on growing arrays and objects","status":"published","published":"2026-04-16T15:49:11Z","modified":"2026-06-01T00:32:22.421644078Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"MGASA-2026-0188","title":"Updated jq packages fix security vulnerabilities","description":"An integer overflow arises when assigning value using an index of\n2147483647, the signed integer limit. This causes a denial of service.\n(CVE-2024-23337)\nIt was discovered that jq did not correctly handle certain string\nconcatenations. An attacker could possibly use this issue to cause a\ndenial of service or execute arbitrary code. (CVE-2026-32316)\nIt was discovered that jq did not correctly handle recursion in certain\ncircumstances. An attacker could possibly use this issue to cause a\ndenial of service. (CVE-2026-33947)\nIt was discovered that jq did not correctly handle improperly terminated\nstrings. An attacker could possibly use this issue to cause a denial of\nservice or execute arbitrary code. (CVE-2026-33948)\nIt was discovered that jq did not correctly handle checking certain\nvariable types. An attacker could possibly use this issue to cause a\ndenial of service or leak sensitive information. (CVE-2026-39956)\nIt was discovered that jq did not correctly handle certain string\nformatting. An attacker could possibly use this issue to leak sensitive\ninformation or cause a denial of service. (CVE-2026-39979)\nIt was discovered that jq used a fixed seed for hash table operations.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2026-40164)\nA heap-buffer-overflow is present in function `jv_string_vfmt` in the\njq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c,\nline 1456 `void* p = malloc(sz); (CVE-2025-48060)\nTop-level jq programs loaded from a file with -f are truncated at the\nfirst embedded NUL byte on current upstream HEAD. A crafted filter file\nsuch as . followed by \\x00 and arbitrary suffix compiles and executes as\nonly the prefix before the NUL. This leaves jq with a\npost-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path\neven though the JSON parser path has already been fixed.\n(CVE-2026-41256)\nThe ordinary module loader recurses without cycle detection when two\notherwise valid modules include each other (CVE-2026-44777)\n","status":"published","published":"2026-06-10T05:07:06Z","modified":"2026-06-10T05:33:58.122831752Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15233-1","title":"jq-1.8.1-1.1 on GA media","description":"These are all security issues fixed in the jq-1.8.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:31.510701Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2025:02384-1","title":"Security update for jq","description":"This update for jq fixes the following issues:\n\n- CVE-2024-23337: Fixed signed integer overflow in jv.c:jvp_array_write (bsc#1243450).\n","status":"published","published":"2025-07-18T16:46:06Z","modified":"2026-02-04T04:08:39.791538Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:20506-1","title":"Security update for jq","description":"This update for jq fixes the following issues:\n\n- CVE-2024-23337: Fixed signed integer overflow in jv.c:jvp_array_write (bsc#1243450)\n","status":"published","published":"2025-07-24T11:41:34Z","modified":"2026-03-23T04:48:17.826749Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:20591-1","title":"Security update for jq","description":"This update for jq fixes the following issues:\n\n- CVE-2025-48060: Fixed stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (bsc#1244116)\n- CVE-2024-23337: Fixed signed integer overflow in jv.c:jvp_array_write (bsc#1243450)\n- CVE-2024-53427: Fixed stack-buffer-overflow in the decNumberCopy function in decNumber.c (bsc#1238078)\n","status":"published","published":"2025-08-08T10:28:21Z","modified":"2026-03-23T04:50:12.118579Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"USN-7657-1","title":"jq vulnerabilities","description":"It was discovered that jq incorrectly handled certain values when parsing\nJSON data. A remote attacker could possibly use this issue to cause jq to\ncrash, resulting in a denial of service. (CVE-2024-23337)\n\nIt was discovered that jq incorrectly handled NaN values when parsing JSON\ndata. A remote attacker could possibly use this issue to cause jq to crash,\nresulting in a denial of service. This issue only affected Ubuntu 24.04\nLTS, and Ubuntu 25.04. (CVE-2024-53427)\n\nIt was discovered that jq incorrectly handled certain values when parsing\nJSON data. A remote attacker could use this issue to cause jq to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2025-48060)","status":"published","published":"2025-07-21T12:05:03Z","modified":"2026-04-27T18:10:16.868181Z","updated_at":"2026-11-02T16:58:21.91885Z"},{"id":"USN-7657-2","title":"jq vulnerabilities","description":"USN-7657-1 fixed CVE-2024-23337 and CVE-2025-48060 in jq. This update\nprovides the corresponding fixes for Ubuntu 20.04 LTS, Ubuntu 18.04 LTS,\nand Ubuntu 16.04 LTS.\n\nOriginal advisory details:\n\nIt was discovered that jq incorrectly handled certain values when parsing\nJSON data. A remote attacker could possibly use this issue to cause jq to\ncrash, resulting in a denial of service. (CVE-2024-23337)\n\nIt was discovered that jq incorrectly handled certain values when parsing\nJSON data. A remote attacker could use this issue to cause jq to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2025-48060)\n","status":"published","published":"2025-07-22T15:54:43Z","modified":"2026-06-25T13:32:30.562003329Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}