{"id":"CVE-2024-53427","aliases":["ALPINE-CVE-2024-53427","AZL-57376","BELL-CVE-2024-53427","DEBIAN-CVE-2024-53427","EUVD-2025-5310","GHSA-8mxc-vqrq-gcm8","GHSA-x6c3-qv5r-7q22","ROOT-OS-DEBIAN-12-CVE-2024-53427","SUSE-SU-2025:20591-1","SUSE-SU-2026:23873-1","SUSE-SU-2026:4275-1","UBUNTU-CVE-2024-53427","USN-7657-1","openSUSE-SU-2025:15161-1"],"status":"published","title":"jq v1.7.1 contains a stack-buffer-overflow in the decNumberCopy function within decNumber.c.","description":"decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., \"1 NaN123\" immediately followed by many more digits).","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00391,"percentile":0.33673,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-843"],"published":"2025-02-26T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"jq","fixed_in":["1.8.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"jq","fixed_in":["1.8.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"jq","fixed_in":["1.8.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"jq","fixed_in":["1.7.1-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"jq","fixed_in":["1.8.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"jq","fixed_in":["1.8.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jq","fixed_in":["1.7.1-6+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jq","fixed_in":["1.7.1-5"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"jq","fixed_in":["1.7.1-3ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"jq","fixed_in":["1.7.1-3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.1-r0"},{"fixed":"1.8.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7-r0"},{"fixed":"1.8.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-6+deb13u3"}]}],"versions":["1.7.1-6+deb13u1","1.7.1-6+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-slfo.1.1_2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-150000.3.25.1"}]}],"bundled":17},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-3ubuntu0.24.04.1"}]}],"versions":["1.6-3","1.7-1","1.7.1-2","1.7.1-3","1.7.1-3build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-2.1ubuntu3.1"}]}],"versions":["1.6-2.1ubuntu2","1.6-2.1ubuntu3"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-3ubuntu0.24.04.1"}]}],"versions":["1.6-3","1.7-1","1.7.1-2","1.7.1-3","1.7.1-3build1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-3.1"}]}]}],"products":[{"vendor":"jqlang","product":"jq"}],"references":[{"url":"https://github.com/jqlang/jq/issues/3196","tags":["Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://gist.github.com/Ekkosun/a83870ce7f3b7813b9b462a395e8ad92","tags":["Third Party Advisory","web"]},{"url":"https://github.com/jqlang/jq/blob/71c2ab509a8628dbbad4bc7b3f98a64aa90d3297/src/decNumber/decNumber.c#L3375","tags":["Product","web"]},{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-x6c3-qv5r-7q22","tags":["Vendor Advisory","advisory","report"]},{"url":"https://github.com/jqlang/jq/issues/3296","tags":["Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53427","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-8mxc-vqrq-gcm8"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-53427","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-53427","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53427.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-53427","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520591-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1238078","tags":["report"]},{"url":"https://bugzilla.suse.com/1243450","tags":["report"]},{"url":"https://bugzilla.suse.com/1244116","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48060","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623873-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215737","tags":["report"]},{"url":"https://bugzilla.suse.com/1218034","tags":["report"]},{"url":"https://bugzilla.suse.com/1218038","tags":["report"]},{"url":"https://bugzilla.suse.com/1248600","tags":["report"]},{"url":"https://bugzilla.suse.com/1262043","tags":["report"]},{"url":"https://bugzilla.suse.com/1262044","tags":["report"]},{"url":"https://bugzilla.suse.com/1262072","tags":["report"]},{"url":"https://bugzilla.suse.com/1265060","tags":["report"]},{"url":"https://bugzilla.suse.com/1265061","tags":["report"]},{"url":"https://bugzilla.suse.com/1265062","tags":["report"]},{"url":"https://bugzilla.suse.com/1265070","tags":["report"]},{"url":"https://bugzilla.suse.com/1265071","tags":["report"]},{"url":"https://bugzilla.suse.com/1265075","tags":["report"]},{"url":"https://bugzilla.suse.com/1265076","tags":["report"]},{"url":"https://bugzilla.suse.com/1269220","tags":["report"]},{"url":"https://bugzilla.suse.com/1269221","tags":["report"]},{"url":"https://bugzilla.suse.com/1269390","tags":["report"]},{"url":"https://bugzilla.suse.com/976992","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40612","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54679","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264275-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-53427","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-53427","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7657-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-23337","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-48060","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JTB54BUKGI3PO5QEDVXN4XSDB2RSYZ7F/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-53427","description":"decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., \"1 NaN123\" immediately followed by many more digits).","status":"published","published":"2025-02-26T00:00:00Z","modified":"2025-03-28T16:39:39.47Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:34:17.523201Z"}],"euvd":[{"id":"EUVD-2025-5310","description":"decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., \"1 NaN123\" immediately followed by many more digits).","status":"published","published":"2025-02-26T00:00:00Z","modified":"2025-03-28T16:39:39Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:47.656339Z"}],"ghsa":[{"id":"GHSA-8mxc-vqrq-gcm8","title":"jq v1.7.1 contains a stack-buffer-overflow in the decNumberCopy function within decNumber.c.","description":"jq v1.7.1 contains a stack-buffer-overflow in the decNumberCopy function within decNumber.c.","status":"published","published":"2025-02-26T18:30:38Z","modified":"2025-03-02T03:31:33Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T15:00:06.147133Z"}],"nvd":[{"id":"CVE-2024-53427","description":"decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., \"1 NaN123\" immediately followed by many more digits).","status":"published","published":"2025-02-26T16:15:16.237Z","modified":"2026-06-17T08:08:52.94Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:10:44.508862Z"}],"osv":[{"id":"ALPINE-CVE-2024-53427","description":"decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., \"1 NaN123\" immediately followed by many more digits).","status":"published","published":"2025-02-26T16:15:16.237Z","modified":"2026-11-02T11:17:50.12740565Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2024-53427","status":"published","published":"2025-02-28T05:58:26.72788Z","modified":"2026-01-26T09:38:06.419282Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:20.963569Z"},{"id":"CVE-2024-53427","description":"decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., \"1 NaN123\" immediately followed by many more digits).","status":"published","published":"2025-02-26T00:00:00Z","modified":"2026-10-28T02:30:31.960174721Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T15:44:44.451316Z"},{"id":"DEBIAN-CVE-2024-53427","description":"decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., \"1 NaN123\" immediately followed by many more digits).","status":"published","published":"2025-02-26T16:15:16.237Z","modified":"2026-11-02T12:02:56.142745982Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:44.117337Z"},{"id":"UBUNTU-CVE-2024-53427","description":"decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., \"1 NaN123\" immediately followed by many more digits).","status":"published","published":"2025-02-26T16:15:00Z","modified":"2026-04-22T15:21:22.317835Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:11.182485Z"},{"id":"AZL-57376","title":"CVE-2024-53427 affecting package jq for versions less than 1.7.1-2","description":"decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., \"1 NaN123\" immediately followed by many more digits).","status":"published","published":"2025-02-26T16:15:16Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.162429Z"},{"id":"openSUSE-SU-2025:15161-1","title":"jq-1.7.1-3.1 on GA media","description":"These are all security issues fixed in the jq-1.7.1-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-26T00:00:00Z","modified":"2026-03-23T04:53:25.572634Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2024-53427","title":"CVE-2024-53427 in rootio-jq - Patched by Root","description":"Root has patched CVE-2024-53427 in the rootio-jq package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2025-08-12T08:24:43Z","modified":"2026-08-27T14:00:05.320956764Z","updated_at":"2026-11-02T15:53:30.983521Z"},{"id":"SUSE-SU-2025:20591-1","title":"Security update for jq","description":"This update for jq fixes the following issues:\n\n- CVE-2025-48060: Fixed stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (bsc#1244116)\n- CVE-2024-23337: Fixed signed integer overflow in jv.c:jvp_array_write (bsc#1243450)\n- CVE-2024-53427: Fixed stack-buffer-overflow in the decNumberCopy function in decNumber.c (bsc#1238078)\n","status":"published","published":"2025-08-08T10:28:21Z","modified":"2026-03-23T04:50:12.118579Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2026:23873-1","title":"Security update for jq","description":"This update for jq fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2015-8863: heap buffer overflow in tokenadd() function (bsc#976992).\n- CVE-2023-50246: improper memory handling can lead to a heap buffer overflow in `decNumberToString` (bsc#1218034).\n- CVE-2023-50268: stack-based buffer overflow in builds using decNumber (bsc#1218038).\n- CVE-2024-53427: stack-buffer-overflow in the decNumberCopy function in decNumber.c (bsc#1238078).\n- CVE-2025-9403: reachable assertion in run_jq_tests() (bsc#1248600).\n- CVE-2026-32316: denial of Service or potential arbitrary code execution due to integer overflow and heap-based buffer\n  overflow (bsc#1262044).\n- CVE-2026-33948: CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).\n- CVE-2026-40164: predictable hash collisions can lead to a denial of service (bsc#1262072).\n- CVE-2026-40612: jv_contains recurses into nested arrays/objects with no depth limit and can cause a stack overflow\n  (bsc#1265060).\n- CVE-2026-41256: embedded NUL truncates top-level jq programs loaded with -f and can lead to execution of unintended\n  programs (bsc#1265061).\n- CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS (bsc#1265062).\n- CVE-2026-43894: signed integer overflow in `decNumber` can lead to out-of-bounds memory write (bsc#1265070).\n- CVE-2026-43895: embedded NUL bytes in import paths can lead to policy bypass and sensitive information disclosure\n  (bsc#1265071).\n- CVE-2026-43896: unbounded recursion in `jv_object_merge_recursive()` can lead to C stack exhaustion and a process\n  crash (bsc#1265075).\n- CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules `include` each other can lead\n  to stack exhaustion and process crash (bsc#1265076).\n- CVE-2026-47770: stack overflow in deep structural equality (bsc#1269221).\n- CVE-2026-49839: `--rawfile` invalid-state reuse after `String too long` can lead to a heap buffer overflow\n  (bsc#1269220).\n- CVE-2026-54679: integer overflow in `jvp_string_append` can lead to a buffer overrun on 32-bit systems (bsc#1269390).\n\nChanges for jq:\n\nUpdate to version 1.7.1:\n\n * Make the default background color more suitable for bright\n backgrounds.\n * Allow passing the inline jq script after --.\n * Fix possible uninitialised value dereference if jq_init() fails\n * Simplify paths/0 and paths/1.\n * Reject U+001F in string literals.\n * Remove unused nref accumulator in block_bind_library.\n * Remove a bunch of unused variables, and useless assignments.\n * main.c: Remove unused EXIT_STATUS_EXACT option.\n * Actually use the number correctly casted from double to int as\n index.\n * src/builtin.c: remove unnecessary jv_copy-s in\n type_error/type_error2.\n * Remove undefined behavior caught by LLVM 10 UBSAN.\n * Convert decnum to binary64 (double) instead of decimal64.\n This makes jq behave like the JSON specification suggests and\n more similar to other languages.\n * Fix memory leaks on invalid input for ltrimstr/1 and\n rtrimstr/1.\n * Fix memory leak on failed get for setpath/2.\n * Fix nan from json parsing also for nans with payload that\n start with 'n'.\n * Allow carriage return characters in comments.\n * Generate links in the man page.\n * Add extern C for C++.\n * Make object key color configurable using JQ_COLORS environment\n variable.\n * Change the default color of null to Bright Black.\n * Respect NO_COLOR environment variable to disable color output.\n * Improved --help output. Now mentions all options and nicer\n order.\n * Fix multiple issues of exit code using --exit-code/-e option.\n * Add --raw-output0 for NUL (zero byte) separated output.\n * Fix assert crash and validate JSON for --jsonarg.\n * Remove deprecated --argfile option.\n * Use decimal number literals to preserve precision. Comparison\n operations respects precision but arithmetic operations might\n truncate.\n * Adds new builtin pick(stream) to emit a projection of the\n input object or array.\n * Adds new builtin debug(msgs) that works like debug but applies\n a filter on the input before writing to stderr.\n * Adds new builtin scan($re; $flags). Was documented but not\n implemented.\n * Adds new builtin abs to get absolute value. This potentially\n allows the literal value of numbers to be preserved as length\n and fabs convert to float.\n * Allow if without else-branch. When skipped the else-branch\n will be . (identity).\n * Allow use of $binding as key in object literals.\n * Allow dot between chained indexes when using .[\"index\"]\n * Allow dot for chained value iterator .[], .[]?\n * Fix try/catch catches more than it should.\n * Speed up and refactor some builtins, also remove\n scalars_or_empty/0.\n * Now halt and halt_error exit immediately instead of continuing\n to the next input.\n * Fix issue converting string to number after previous convert\n error.\n * Fix issue representing large numbers on some platforms causing\n invalid JSON output.\n * Fix deletion using assigning empty against arrays.\n * Allow keywords to be used as binding name in more places.\n * Allow using nan as NaN in JSON.\n * Expose a module's function names in modulemeta.\n * Fix contains/1 to handle strings with NUL.\n * Fix stderr/0 to output raw text without any decoration.\n * Fix nth/2 to emit empty on index out of range.\n * Fix implode to not assert and instead replace invalid unicode\n codepoints.\n * Fix indices/1 and rindex/1 in case of overlapping matches in\n strings.\n * Fix sub/3 to resolve issues involving global search-and-replace\n (gsub) operations.\n * Fix empty regular expression matches.\n * Fix overflow exception of the modulo operator.\n * Fix string multiplication by 0 (and less than 1) to emit empty\n string.\n * Fix segfault when using libjq and threads.\n * Fix constant folding of division and reminder with zero\n divisor.\n * Fix error/0, error/1 to throw null error.\n * Simpler and faster transpose.\n * Simple and efficient implementation of walk/1.\n * Remove deprecated filters leaf_paths, recurse_down.\n","status":"published","published":"2026-09-17T08:05:35Z","modified":"2026-09-28T18:23:12.243926519Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:4275-1","title":"Security update for jq","description":"This update for jq fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2015-8863: heap buffer overflow in tokenadd() function (bsc#976992).\n- CVE-2023-50246: improper memory handling can lead to a heap buffer overflow in `decNumberToString` (bsc#1218034).\n- CVE-2023-50268: stack-based buffer overflow in builds using decNumber (bsc#1218038).\n- CVE-2024-53427: stack-buffer-overflow in the decNumberCopy function in decNumber.c (bsc#1238078).\n- CVE-2025-9403: reachable assertion in run_jq_tests() (bsc#1248600).\n- CVE-2026-33948: CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).\n- CVE-2026-40164: predictable hash collisions can lead to a denial of service (bsc#1262072).\n- CVE-2026-40612: jv_contains recurses into nested arrays/objects with no depth limit and can cause a stack overflow\n  (bsc#1265060).\n- CVE-2026-41256: embedded NUL truncates top-level jq programs loaded with -f and can lead to execution of unintended\n  programs (bsc#1265061).\n- CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS (bsc#1265062).\n- CVE-2026-43894: signed integer overflow in `decNumber` can lead to out-of-bounds memory write (bsc#1265070).\n- CVE-2026-43895: embedded NUL bytes in import paths can lead to policy bypass and sensitive information disclosure\n  (bsc#1265071).\n- CVE-2026-43896: unbounded recursion in `jv_object_merge_recursive()` can lead to C stack exhaustion and a process\n  crash (bsc#1265075).\n- CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules `include` each other can lead\n  to stack exhaustion and process crash (bsc#1265076).\n- CVE-2026-47770: stack overflow in deep structural equality (bsc#1269221).\n- CVE-2026-49839: `--rawfile` invalid-state reuse after `String too long` can lead to a heap buffer overflow\n  (bsc#1269220).\n- CVE-2026-54679: integer overflow in `jvp_string_append` can lead to a buffer overrun on 32-bit systems (bsc#1269390).\n\nChanges for jq:\n\nUpdate to version 1.7.1:\n\n * Make the default background color more suitable for bright\n backgrounds.\n * Allow passing the inline jq script after --.\n * Fix possible uninitialised value dereference if jq_init() fails\n * Simplify paths/0 and paths/1.\n * Reject U+001F in string literals.\n * Remove unused nref accumulator in block_bind_library.\n * Remove a bunch of unused variables, and useless assignments.\n * main.c: Remove unused EXIT_STATUS_EXACT option.\n * Actually use the number correctly casted from double to int as\n index.\n * src/builtin.c: remove unnecessary jv_copy-s in\n type_error/type_error2.\n * Remove undefined behavior caught by LLVM 10 UBSAN.\n * Convert decnum to binary64 (double) instead of decimal64.\n This makes jq behave like the JSON specification suggests and\n more similar to other languages.\n * Fix memory leaks on invalid input for ltrimstr/1 and\n rtrimstr/1.\n * Fix memory leak on failed get for setpath/2.\n * Fix nan from json parsing also for nans with payload that\n start with 'n'.\n * Allow carriage return characters in comments.\n * Generate links in the man page.\n * Add extern C for C++.\n * Make object key color configurable using JQ_COLORS environment\n variable.\n * Change the default color of null to Bright Black.\n * Respect NO_COLOR environment variable to disable color output.\n * Improved --help output. Now mentions all options and nicer\n order.\n * Fix multiple issues of exit code using --exit-code/-e option.\n * Add --raw-output0 for NUL (zero byte) separated output.\n * Fix assert crash and validate JSON for --jsonarg.\n * Remove deprecated --argfile option.\n * Use decimal number literals to preserve precision. Comparison\n operations respects precision but arithmetic operations might\n truncate.\n * Adds new builtin pick(stream) to emit a projection of the\n input object or array.\n * Adds new builtin debug(msgs) that works like debug but applies\n a filter on the input before writing to stderr.\n * Adds new builtin scan($re; $flags). Was documented but not\n implemented.\n * Adds new builtin abs to get absolute value. This potentially\n allows the literal value of numbers to be preserved as length\n and fabs convert to float.\n * Allow if without else-branch. When skipped the else-branch\n will be . (identity).\n * Allow use of $binding as key in object literals.\n * Allow dot between chained indexes when using .['index']\n * Allow dot for chained value iterator .[], .[]?\n * Fix try/catch catches more than it should.\n * Speed up and refactor some builtins, also remove\n scalars_or_empty/0.\n * Now halt and halt_error exit immediately instead of continuing\n to the next input.\n * Fix issue converting string to number after previous convert\n error.\n * Fix issue representing large numbers on some platforms causing\n invalid JSON output.\n * Fix deletion using assigning empty against arrays.\n * Allow keywords to be used as binding name in more places.\n * Allow using nan as NaN in JSON.\n * Expose a module's function names in modulemeta.\n * Fix contains/1 to handle strings with NUL.\n * Fix stderr/0 to output raw text without any decoration.\n * Fix nth/2 to emit empty on index out of range.\n * Fix implode to not assert and instead replace invalid unicode\n codepoints.\n * Fix indices/1 and rindex/1 in case of overlapping matches in\n strings.\n * Fix sub/3 to resolve issues involving global search-and-replace\n (gsub) operations.\n * Fix empty regular expression matches.\n * Fix overflow exception of the modulo operator.\n * Fix string multiplication by 0 (and less than 1) to emit empty\n string.\n * Fix segfault when using libjq and threads.\n * Fix constant folding of division and reminder with zero\n divisor.\n * Fix error/0, error/1 to throw null error.\n * Simpler and faster transpose.\n * Simple and efficient implementation of walk/1.\n * Remove deprecated filters leaf_paths, recurse_down.\n","status":"published","published":"2026-09-21T07:33:03Z","modified":"2026-09-21T17:15:07.382382398Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"USN-7657-1","title":"jq vulnerabilities","description":"It was discovered that jq incorrectly handled certain values when parsing\nJSON data. A remote attacker could possibly use this issue to cause jq to\ncrash, resulting in a denial of service. (CVE-2024-23337)\n\nIt was discovered that jq incorrectly handled NaN values when parsing JSON\ndata. A remote attacker could possibly use this issue to cause jq to crash,\nresulting in a denial of service. This issue only affected Ubuntu 24.04\nLTS, and Ubuntu 25.04. (CVE-2024-53427)\n\nIt was discovered that jq incorrectly handled certain values when parsing\nJSON data. A remote attacker could use this issue to cause jq to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2025-48060)","status":"published","published":"2025-07-21T12:05:03Z","modified":"2026-04-27T18:10:16.868181Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}