{"id":"CVE-2026-32316","aliases":["ALPINE-CVE-2026-32316","AZL-82922","BELL-CVE-2026-32316","CLSA-2026-1777322146","CLSA-2026-1777881308","DEBIAN-CVE-2026-32316","EUVD-2026-22039","GHSA-q3h9-m34w-h76f","MGASA-2026-0188","OESA-2026-1981","RHSA-2026:8579","SUSE-SU-2026:22545-1","SUSE-SU-2026:22566-1","SUSE-SU-2026:22664-1","SUSE-SU-2026:22705-1","SUSE-SU-2026:23873-1","SUSE-SU-2026:2983-1","UBUNTU-CVE-2026-32316","USN-8202-1","USN-8202-2","openSUSE-SU-2026:10850-1","openSUSE-SU-2026:21248-1"],"status":"published","title":"jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow","description":"jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00805,"percentile":0.5724,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122","CWE-190"],"published":"2026-04-13T17:49:34Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"jq","fixed_in":["1.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"jq","fixed_in":["1.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"jq","fixed_in":["1.8.2-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"jq","fixed_in":["1.7.1-5"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"jq","fixed_in":["1.8.1-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"jq","fixed_in":["1.8.1-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"jq","fixed_in":["1.8.1-r1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"jq","fixed_in":["1.6-14.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"jq-devel","fixed_in":["1.6-14.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"jq","fixed_in":["1.6-2.1+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jq","fixed_in":["1.7.1-6+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jq","fixed_in":["1.8.1-5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jq","fixed_in":["1.5+dfsg-1ubuntu0.1+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"jq","fixed_in":["1.5+dfsg-2ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"jq","fixed_in":["1.6-1ubuntu0.20.04.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"jq","fixed_in":["1.6-2.1ubuntu3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"jq","fixed_in":["1.7.1-3ubuntu0.24.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"jq","fixed_in":["1.8.1-3ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"jq","fixed_in":["1.8.1-4ubuntu2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-5"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6-r2"},{"fixed":"1.8.1-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.1-r0"},{"fixed":"1.8.1-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6-r1"},{"fixed":"1.8.1-r1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-14.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"jq-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-14.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-17.el9_6.2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"jq-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-17.el9_6.2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-2.1+deb12u3"}]}],"versions":["1.6-2.1","1.6-2.1+deb12u1","1.6-2.1+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-6+deb13u3"}]}],"versions":["1.7.1-6+deb13u1","1.7.1-6+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-5"}]}],"versions":["1.8.0-1","1.8.1-1","1.8.1-2","1.8.1-3","1.8.1-4"]},{"source":"osv","ecosystem":"Mageia:9","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-3.1.mga9"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-3.oe2403sp3"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-3.oe2403sp1"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-3.oe2403sp2"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-3.oe2403sp3"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-3.oe2003sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-3.oe2203sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-3.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"jq-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-3.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-160000.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-160000.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-160000.3.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-slfo.1.1_3.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-150000.3.20.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-150000.3.20.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-150000.3.20.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-150000.3.20.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-8","1.3-1","1.3-1.1ubuntu1","1.3-1.1ubuntu1.1","1.3-1.1ubuntu1.1+esm3","1.3-1.1ubuntu1.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5+dfsg-1ubuntu0.1+esm4"}]}],"versions":["1.4-2.1","1.5+dfsg-1","1.5+dfsg-1ubuntu0.1","1.5+dfsg-1ubuntu0.1+esm2","1.5+dfsg-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5+dfsg-2ubuntu0.1~esm2"}]}],"versions":["1.5+dfsg-2","1.5+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-1ubuntu0.20.04.1+esm2"}]}],"versions":["1.5+dfsg-2build1","1.6-1","1.6-1ubuntu0.20.04.1","1.6-1ubuntu0.20.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-2.1ubuntu3.2"}]}],"versions":["1.6-2.1ubuntu2","1.6-2.1ubuntu3","1.6-2.1ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-3ubuntu0.24.04.2"}]}],"versions":["1.6-3","1.7-1","1.7.1-2","1.7.1-3","1.7.1-3build1","1.7.1-3ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-3ubuntu1.1"}]}],"versions":["1.7.1-3ubuntu1","1.7.1-6ubuntu1","1.8.1-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-4ubuntu2"}]}],"versions":["1.8.1-3ubuntu1","1.8.1-4ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3-1.1ubuntu1.1+esm4"}]}],"versions":["1.2-8","1.3-1","1.3-1.1ubuntu1","1.3-1.1ubuntu1.1","1.3-1.1ubuntu1.1+esm3"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5+dfsg-1ubuntu0.1+esm4"}]}],"versions":["1.4-2.1","1.5+dfsg-1","1.5+dfsg-1ubuntu0.1","1.5+dfsg-1ubuntu0.1+esm2","1.5+dfsg-1ubuntu0.1+esm3"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5+dfsg-2ubuntu0.1~esm2"}]}],"versions":["1.5+dfsg-2","1.5+dfsg-2ubuntu0.1~esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-1ubuntu0.20.04.1+esm2"}]}],"versions":["1.5+dfsg-2build1","1.6-1","1.6-1ubuntu0.20.04.1","1.6-1ubuntu0.20.04.1+esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-2.1ubuntu3.2"}]}],"versions":["1.6-2.1ubuntu2","1.6-2.1ubuntu3","1.6-2.1ubuntu3.1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-3ubuntu0.24.04.2"}]}],"versions":["1.6-3","1.7-1","1.7.1-2","1.7.1-3","1.7.1-3build1","1.7.1-3ubuntu0.24.04.1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-3ubuntu1.1"}]}],"versions":["1.7.1-3ubuntu1","1.7.1-6ubuntu1","1.8.1-3ubuntu1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-4ubuntu2"}]}],"versions":["1.8.1-3ubuntu1","1.8.1-4ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-3.1"}]}],"bundled":13},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"jq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-160000.3.1"}]}],"bundled":11}],"products":[{"vendor":"jqlang","product":"jq"}],"references":[{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-q3h9-m34w-h76f","tags":["x_refsource_CONFIRM","Exploit","Patch","Vendor Advisory","advisory","article","report"]},{"url":"https://github.com/jqlang/jq/commit/e47e56d226519635768e6aab2f38f0ab037c09e5","tags":["x_refsource_MISC","Patch","fix","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/10/msg00034.html","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-32316","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32316","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-32316","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1777322146.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1777881308.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32316.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-32316","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0188.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34443","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/04/15/8","tags":["web"]},{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p","tags":["advisory","article"]},{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-32cx-cvvh-2wj9","tags":["advisory","article"]},{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-xwrw-4f8h-rjvg","tags":["advisory","article"]},{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-6gc3-3g9p-xx28","tags":["advisory","article"]},{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-wwj8-gxm6-jc29","tags":["advisory","article"]},{"url":"https://github.com/jqlang/jq/security/advisories/GHSA-gf4g-95wj-4q4r","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1981","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33947","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33948","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39956","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39979","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40164","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8579","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40164","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39979","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39956","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33948","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33947","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32316","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8579.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457929","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32316","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458038","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33947","tags":["advisory"]},{"url":"https://github.com/jqlang/jq/commit/fb59f1491058d58bdc3e8dd28f1773d1ac690a1f","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458085","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33948","tags":["advisory"]},{"url":"https://github.com/jqlang/jq/commit/6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458076","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39956","tags":["advisory"]},{"url":"https://github.com/jqlang/jq/commit/fdf8ef0f0810e3d365cdd5160de43db46f57ed03","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458077","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39979","tags":["advisory"]},{"url":"https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458084","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40164","tags":["advisory"]},{"url":"https://github.com/jqlang/jq/commit/0c7d133c3c7e37c00b6d46b658a02244fdd3c784","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622545-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1244116","tags":["report"]},{"url":"https://bugzilla.suse.com/1262043","tags":["report"]},{"url":"https://bugzilla.suse.com/1262044","tags":["report"]},{"url":"https://bugzilla.suse.com/1262069","tags":["report"]},{"url":"https://bugzilla.suse.com/1262070","tags":["report"]},{"url":"https://bugzilla.suse.com/1262071","tags":["report"]},{"url":"https://bugzilla.suse.com/1262072","tags":["report"]},{"url":"https://bugzilla.suse.com/1265060","tags":["report"]},{"url":"https://bugzilla.suse.com/1265061","tags":["report"]},{"url":"https://bugzilla.suse.com/1265062","tags":["report"]},{"url":"https://bugzilla.suse.com/1265070","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40612","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43894","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622566-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622664-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622705-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248600","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9403","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623873-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215737","tags":["report"]},{"url":"https://bugzilla.suse.com/1218034","tags":["report"]},{"url":"https://bugzilla.suse.com/1218038","tags":["report"]},{"url":"https://bugzilla.suse.com/1238078","tags":["report"]},{"url":"https://bugzilla.suse.com/1265071","tags":["report"]},{"url":"https://bugzilla.suse.com/1265075","tags":["report"]},{"url":"https://bugzilla.suse.com/1265076","tags":["report"]},{"url":"https://bugzilla.suse.com/1269220","tags":["report"]},{"url":"https://bugzilla.suse.com/1269221","tags":["report"]},{"url":"https://bugzilla.suse.com/1269390","tags":["report"]},{"url":"https://bugzilla.suse.com/976992","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54679","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262983-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-32316","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8202-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8202-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-33947","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33948","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-39956","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-39979","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40164","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-32316","title":"jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow","description":"jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5.","status":"published","published":"2026-04-13T17:49:34.095Z","modified":"2026-10-16T22:06:40.448Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-122","CWE-190"],"updated_at":"2026-11-02T14:19:57.818032Z"}],"euvd":[{"id":"EUVD-2026-22039","description":"jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5.","status":"published","published":"2026-04-13T17:49:34Z","modified":"2026-10-16T22:06:40Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T17:00:01.37578Z"}],"nvd":[{"id":"CVE-2026-32316","description":"jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5.","status":"published","published":"2026-04-13T18:16:29.42Z","modified":"2026-10-26T22:10:00.163Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-122","CWE-190"],"updated_at":"2026-11-02T14:12:14.37744Z"}],"osv":[{"id":"ALPINE-CVE-2026-32316","description":"jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5.","status":"published","published":"2026-04-13T18:16:29.42Z","modified":"2026-10-01T02:17:49.236387414Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2026-32316","status":"published","published":"2026-04-14T06:09:39.429752Z","modified":"2026-06-13T07:15:06.219598256Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.572955Z"},{"id":"CVE-2026-32316","title":"jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow","description":"jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5.","status":"published","published":"2026-04-13T17:49:34.095Z","modified":"2026-10-28T11:10:14.869554518Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"cwes":["CWE-122","CWE-190"],"updated_at":"2026-11-02T15:45:01.218144Z"},{"id":"DEBIAN-CVE-2026-32316","description":"jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5.","status":"published","published":"2026-04-13T18:16:29.42Z","modified":"2026-10-27T09:47:28.421501686Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.232518Z"},{"id":"OESA-2026-1981","title":"jq security update","description":"jq is a lightweight and flexible command-line JSON processor. you can use it to slice and filter and map and transform structured data. It is written in portable C, and it has zero runtime dependencies. it can mangle the data format that you have into the one that you want.\r\n\r\nSecurity Fix(es):\n\njq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5.(CVE-2026-32316)\n\njq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(), and delpaths_sorted() in jq\u0026apos;s src/jv_aux.c use unbounded recursion whose depth is controlled by the length of a caller-supplied path array, with no depth limit enforced. An attacker can supply a JSON document containing a flat array of ~65,000 integers (~200 KB) that, when used as a path argument by a trusted jq filter, exhausts the C call stack and crashes the process with a segmentation fault (SIGSEGV). This bypass works because the existing MAX_PARSING_DEPTH (10,000) limit only protects the JSON parser, not runtime path operations where arrays can be programmatically constructed to arbitrary lengths. The impact is denial of service (unrecoverable crash) affecting any application or service that processes untrusted JSON input through jq\u0026apos;s setpath, getpath, or delpaths builtins. This issue has been addressed in commit fb59f1491058d58bdc3e8dd28f1773d1ac690a1f.(CVE-2026-33947)\n\njq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.(CVE-2026-33948)\n\njq is a command-line JSON processor. In commits after 69785bf77f86e2ea1b4a20ca86775916889e91c9, the _strindices builtin in jq\u0026apos;s src/builtin.c passes its arguments directly to jv_string_indexes() without verifying they are strings, and jv_string_indexes() in src/jv.c relies solely on assert() checks that are stripped in release builds compiled with -DNDEBUG. This allows an attacker to crash jq trivially with input like _strindices(0), and by crafting a numeric value whose IEEE-754 bit pattern maps to a chosen pointer, achieve a controlled pointer dereference and limited memory read/probe primitive. Any deployment that evaluates untrusted jq filters against a release build is vulnerable. This issue has been patched in commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03.(CVE-2026-39956)\n\njq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.(CVE-2026-39979)\n\njq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n), turning any jq expression into an O(n²) operation and causing significant CPU exhaustion. This affected common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more practical to exploit than existing heap overflow issues since it required only a small payload. This issue has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784.(CVE-2026-40164)","status":"published","published":"2026-04-17T11:10:59Z","modified":"2026-08-18T01:19:39.227731804Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"RHSA-2026:8579","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-20T10:12:13Z","modified":"2026-10-06T10:31:05.437646722Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"UBUNTU-CVE-2026-32316","description":"jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5.","status":"published","published":"2026-04-13T18:16:00Z","modified":"2026-05-20T16:25:21.431436083Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"AZL-82922","title":"CVE-2026-32316 affecting package jq for versions less than 1.7.1-5","description":"jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5.","status":"published","published":"2026-04-13T18:16:29Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.988217Z"},{"id":"CLSA-2026-1777322146","title":"jq: Fix of CVE-2026-32316","description":"- CVE-2026-32316: fix heap buffer overflow in jvp_string_append and\n  jvp_string_copy_replace_bad caused by uint32_t overflow in size\n  calculations for strings exceeding INT_MAX bytes","status":"published","published":"2026-04-27T20:35:51Z","modified":"2026-06-01T00:32:28.13183249Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777881308","title":"jq: Fix of 2 CVEs","description":"- CVE-2026-32316: fix heap buffer overflow in jvp_string_append and\n  jvp_string_copy_replace_bad\n- CVE-2026-39979: fix out-of-bounds read in jv_parse_sized","status":"published","published":"2026-05-04T07:55:12Z","modified":"2026-06-01T00:32:50.119468722Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"MGASA-2026-0188","title":"Updated jq packages fix security vulnerabilities","description":"An integer overflow arises when assigning value using an index of\n2147483647, the signed integer limit. This causes a denial of service.\n(CVE-2024-23337)\nIt was discovered that jq did not correctly handle certain string\nconcatenations. An attacker could possibly use this issue to cause a\ndenial of service or execute arbitrary code. (CVE-2026-32316)\nIt was discovered that jq did not correctly handle recursion in certain\ncircumstances. An attacker could possibly use this issue to cause a\ndenial of service. (CVE-2026-33947)\nIt was discovered that jq did not correctly handle improperly terminated\nstrings. An attacker could possibly use this issue to cause a denial of\nservice or execute arbitrary code. (CVE-2026-33948)\nIt was discovered that jq did not correctly handle checking certain\nvariable types. An attacker could possibly use this issue to cause a\ndenial of service or leak sensitive information. (CVE-2026-39956)\nIt was discovered that jq did not correctly handle certain string\nformatting. An attacker could possibly use this issue to leak sensitive\ninformation or cause a denial of service. (CVE-2026-39979)\nIt was discovered that jq used a fixed seed for hash table operations.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2026-40164)\nA heap-buffer-overflow is present in function `jv_string_vfmt` in the\njq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c,\nline 1456 `void* p = malloc(sz); (CVE-2025-48060)\nTop-level jq programs loaded from a file with -f are truncated at the\nfirst embedded NUL byte on current upstream HEAD. A crafted filter file\nsuch as . followed by \\x00 and arbitrary suffix compiles and executes as\nonly the prefix before the NUL. This leaves jq with a\npost-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path\neven though the JSON parser path has already been fixed.\n(CVE-2026-41256)\nThe ordinary module loader recurses without cycle detection when two\notherwise valid modules include each other (CVE-2026-44777)\n","status":"published","published":"2026-06-10T05:07:06Z","modified":"2026-06-10T05:33:58.122831752Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10850-1","title":"jq-1.8.1-3.1 on GA media","description":"These are all security issues fixed in the jq-1.8.1-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-24T00:00:00Z","modified":"2026-05-25T07:45:05.564073704Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:21248-1","title":"Security update for jq","description":"This update for jq fixes the following issues:\n\n- CVE-2025-48060: improper handling of string data in `jv_string_empty` can lead to heap buffer overflow and a crash\n  when processing crafted input (bsc#1244116).\n- CVE-2026-32316: integer overflow within the `jvp_string_append()` and `jvp_string_copy_replace_bad` functions can\n  lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).\n- CVE-2026-33947: unbounded recursion in functions `jv_setpath()`, `jv_getpath()`, and `delpaths_sorted()` can lead to\n  excessive resource consumption when processing crafted JSON input (bsc#1262069).\n- CVE-2026-39956: missing runtime type checks in `_strindices` and `jv_string_indexes()` can lead to a crash when\n  evaluating untrusted jq filters against a release build (bsc#1262070).\n- CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in `jv_parse_sized` can lead to an\n  out-of-bounds read when processing malformed JSON (bsc#1262071).\n- CVE-2026-40164: use of `MurmurHash3` with a hardcoded seed allows pre-computation of key collisions and can lead to a\n  denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).\n- CVE-2026-40612: recursion into nested arrays/objects with no depth limit in `jv_contains` can lead to a C stack\n  exhaustion when processing crafted input (bsc#1265060).\n- CVE-2026-41256: truncation of top-level jq programs loaded with `-f` and can lead to the execution of unintended\n  programs (bsc#1265061).\n- CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS when processing jq\n  bytecode (bsc#1265062).\n- CVE-2026-43894: signed integer overflow in the `decNumberFromString` `D2U()` macro can lead to an out-of-bounds\n  memory write when processing large number literals (bsc#1265070).\n- CVE-2026-33948: improper handling of buffer sizes via `strlen()` instead of `fgets()` in CLI input parsing allows\n  validation bypass via embedded NUL bytes (bsc#1262043).\n","status":"published","published":"2026-07-07T12:32:56Z","modified":"2026-07-09T10:00:11.272938957Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22545-1","title":"Security update for jq","description":"This update for jq fixes the following issues:\n\n- CVE-2025-48060: improper handling of string data in `jv_string_empty` can lead to heap buffer overflow and a crash\n  when processing crafted input (bsc#1244116).\n- CVE-2026-32316: integer overflow within the `jvp_string_append()` and `jvp_string_copy_replace_bad` functions can\n  lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).\n- CVE-2026-33947: unbounded recursion in functions `jv_setpath()`, `jv_getpath()`, and `delpaths_sorted()` can lead to\n  excessive resource consumption when processing crafted JSON input (bsc#1262069).\n- CVE-2026-39956: missing runtime type checks in `_strindices` and `jv_string_indexes()` can lead to a crash when\n  evaluating untrusted jq filters against a release build (bsc#1262070).\n- CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in `jv_parse_sized` can lead to an\n  out-of-bounds read when processing malformed JSON (bsc#1262071).\n- CVE-2026-40164: use of `MurmurHash3` with a hardcoded seed allows pre-computation of key collisions and can lead to a\n  denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).\n- CVE-2026-40612: recursion into nested arrays/objects with no depth limit in `jv_contains` can lead to a C stack\n  exhaustion when processing crafted input (bsc#1265060).\n- CVE-2026-41256: truncation of top-level jq programs loaded with `-f` and can lead to the execution of unintended\n  programs (bsc#1265061).\n- CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS when processing jq\n  bytecode (bsc#1265062).\n- CVE-2026-43894: signed integer overflow in the `decNumberFromString` `D2U()` macro can lead to an out-of-bounds\n  memory write when processing large number literals (bsc#1265070).\n- CVE-2026-33948: improper handling of buffer sizes via `strlen()` instead of `fgets()` in CLI input parsing allows\n  validation bypass via embedded NUL bytes (bsc#1262043).\n","status":"published","published":"2026-07-07T12:32:43Z","modified":"2026-07-14T18:24:37.360228601Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22566-1","title":"Security update for jq","description":"This update for jq fixes the following issues:\n\n- CVE-2025-48060: improper handling of string data in `jv_string_empty` can lead to heap buffer overflow and a crash\n  when processing crafted input (bsc#1244116).\n- CVE-2026-32316: integer overflow within the `jvp_string_append()` and `jvp_string_copy_replace_bad` functions can\n  lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).\n- CVE-2026-33947: unbounded recursion in functions `jv_setpath()`, `jv_getpath()`, and `delpaths_sorted()` can lead to\n  excessive resource consumption when processing crafted JSON input (bsc#1262069).\n- CVE-2026-39956: missing runtime type checks in `_strindices` and `jv_string_indexes()` can lead to a crash when\n  evaluating untrusted jq filters against a release build (bsc#1262070).\n- CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in `jv_parse_sized` can lead to an\n  out-of-bounds read when processing malformed JSON (bsc#1262071).\n- CVE-2026-40164: use of `MurmurHash3` with a hardcoded seed allows pre-computation of key collisions and can lead to a\n  denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).\n- CVE-2026-40612: recursion into nested arrays/objects with no depth limit in `jv_contains` can lead to a C stack\n  exhaustion when processing crafted input (bsc#1265060).\n- CVE-2026-41256: truncation of top-level jq programs loaded with `-f` and can lead to the execution of unintended\n  programs (bsc#1265061).\n- CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS when processing jq\n  bytecode (bsc#1265062).\n- CVE-2026-43894: signed integer overflow in the `decNumberFromString` `D2U()` macro can lead to an out-of-bounds\n  memory write when processing large number literals (bsc#1265070).\n- CVE-2026-33948: improper handling of buffer sizes via `strlen()` instead of `fgets()` in CLI input parsing allows\n  validation bypass via embedded NUL bytes (bsc#1262043).\n","status":"published","published":"2026-07-07T12:32:43Z","modified":"2026-07-15T18:24:12.01568291Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22664-1","title":"Security update for jq","description":"This update for jq fixes the following issues:\n\n- CVE-2026-32316: integer overflow within the `jvp_string_append()` and `jvp_string_copy_replace_bad` functions can\n  lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).\n- CVE-2026-33947: unbounded recursion in functions `jv_setpath()`, `jv_getpath()`, and `delpaths_sorted()` can lead to\n  excessive resource consumption when processing crafted JSON input (bsc#1262069).\n- CVE-2026-39956: missing runtime type checks in `_strindices` and `jv_string_indexes()` can lead to a crash when\n  evaluating untrusted jq filters against a release build (bsc#1262070).\n- CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in `jv_parse_sized` can lead to an\n  out-of-bounds read when processing malformed JSON (bsc#1262071).\n- CVE-2026-40164: use of `MurmurHash3` with a hardcoded seed allows pre-computation of key collisions and can lead to a\n  denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).\n- CVE-2026-40612: recursion into nested arrays/objects with no depth limit in `jv_contains` can lead to a C stack\n  exhaustion when processing crafted input (bsc#1265060).\n- CVE-2026-41256: truncation of top-level jq programs loaded with `-f` and can lead to the execution of unintended\n  programs (bsc#1265061).\n- CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS when processing jq\n  bytecode (bsc#1265062).\n- CVE-2026-43894: signed integer overflow in the `decNumberFromString` `D2U()` macro can lead to an out-of-bounds\n  memory write when processing large number literals (bsc#1265070).\n- CVE-2026-33948: improper handling of buffer sizes via `strlen()` instead of `fgets()` in CLI input parsing allows\n  validation bypass via embedded NUL bytes (bsc#1262043).\n","status":"published","published":"2026-07-03T12:17:50Z","modified":"2026-07-21T18:48:03.033668638Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22705-1","title":"Security update for jq","description":"This update for jq fixes the following issues\n\nSecurity issues fixed:\n\n- CVE-2025-9403: reacheable assertion in `run_jq_tests` can lead to program termination when processing malformed JSON\n  input containing invalid Unicode escape sequences (bsc#1248600).\n- CVE-2026-32316: integer overflow within the `jvp_string_append()` and `jvp_string_copy_replace_bad` functions can\n  lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).\n- CVE-2026-33947: unbounded recursion in functions `jv_setpath()`, `jv_getpath()`, and `delpaths_sorted()` can lead to\n  excessive resource consumption when processing crafted JSON input (bsc#1262069).\n- CVE-2026-33948: improper handling of buffer sizes via `strlen()` instead of `fgets()` in CLI input parsing allows\n  validation bypass via embedded NUL bytes (bsc#1262043).\n- CVE-2026-39956: missing runtime type checks in `_strindices` and `jv_string_indexes()` can lead to a crash when\n  evaluating untrusted jq filters against a release build (bsc#1262070).\n- CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in `jv_parse_sized` can lead to an\n  out-of-bounds read when processing malformed JSON (bsc#1262071).\n- CVE-2026-40164: use of `MurmurHash3` with a hardcoded seed allows pre-computation of key collisions and can lead to a\n  denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).\n\nOther updates and bugfixes:\n\n- spec: add `--enable-pthread-tls`  to configure invocation.\n","status":"published","published":"2026-07-08T11:04:31Z","modified":"2026-07-23T18:24:14.781689482Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:23873-1","title":"Security update for jq","description":"This update for jq fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2015-8863: heap buffer overflow in tokenadd() function (bsc#976992).\n- CVE-2023-50246: improper memory handling can lead to a heap buffer overflow in `decNumberToString` (bsc#1218034).\n- CVE-2023-50268: stack-based buffer overflow in builds using decNumber (bsc#1218038).\n- CVE-2024-53427: stack-buffer-overflow in the decNumberCopy function in decNumber.c (bsc#1238078).\n- CVE-2025-9403: reachable assertion in run_jq_tests() (bsc#1248600).\n- CVE-2026-32316: denial of Service or potential arbitrary code execution due to integer overflow and heap-based buffer\n  overflow (bsc#1262044).\n- CVE-2026-33948: CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).\n- CVE-2026-40164: predictable hash collisions can lead to a denial of service (bsc#1262072).\n- CVE-2026-40612: jv_contains recurses into nested arrays/objects with no depth limit and can cause a stack overflow\n  (bsc#1265060).\n- CVE-2026-41256: embedded NUL truncates top-level jq programs loaded with -f and can lead to execution of unintended\n  programs (bsc#1265061).\n- CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS (bsc#1265062).\n- CVE-2026-43894: signed integer overflow in `decNumber` can lead to out-of-bounds memory write (bsc#1265070).\n- CVE-2026-43895: embedded NUL bytes in import paths can lead to policy bypass and sensitive information disclosure\n  (bsc#1265071).\n- CVE-2026-43896: unbounded recursion in `jv_object_merge_recursive()` can lead to C stack exhaustion and a process\n  crash (bsc#1265075).\n- CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules `include` each other can lead\n  to stack exhaustion and process crash (bsc#1265076).\n- CVE-2026-47770: stack overflow in deep structural equality (bsc#1269221).\n- CVE-2026-49839: `--rawfile` invalid-state reuse after `String too long` can lead to a heap buffer overflow\n  (bsc#1269220).\n- CVE-2026-54679: integer overflow in `jvp_string_append` can lead to a buffer overrun on 32-bit systems (bsc#1269390).\n\nChanges for jq:\n\nUpdate to version 1.7.1:\n\n * Make the default background color more suitable for bright\n backgrounds.\n * Allow passing the inline jq script after --.\n * Fix possible uninitialised value dereference if jq_init() fails\n * Simplify paths/0 and paths/1.\n * Reject U+001F in string literals.\n * Remove unused nref accumulator in block_bind_library.\n * Remove a bunch of unused variables, and useless assignments.\n * main.c: Remove unused EXIT_STATUS_EXACT option.\n * Actually use the number correctly casted from double to int as\n index.\n * src/builtin.c: remove unnecessary jv_copy-s in\n type_error/type_error2.\n * Remove undefined behavior caught by LLVM 10 UBSAN.\n * Convert decnum to binary64 (double) instead of decimal64.\n This makes jq behave like the JSON specification suggests and\n more similar to other languages.\n * Fix memory leaks on invalid input for ltrimstr/1 and\n rtrimstr/1.\n * Fix memory leak on failed get for setpath/2.\n * Fix nan from json parsing also for nans with payload that\n start with 'n'.\n * Allow carriage return characters in comments.\n * Generate links in the man page.\n * Add extern C for C++.\n * Make object key color configurable using JQ_COLORS environment\n variable.\n * Change the default color of null to Bright Black.\n * Respect NO_COLOR environment variable to disable color output.\n * Improved --help output. Now mentions all options and nicer\n order.\n * Fix multiple issues of exit code using --exit-code/-e option.\n * Add --raw-output0 for NUL (zero byte) separated output.\n * Fix assert crash and validate JSON for --jsonarg.\n * Remove deprecated --argfile option.\n * Use decimal number literals to preserve precision. Comparison\n operations respects precision but arithmetic operations might\n truncate.\n * Adds new builtin pick(stream) to emit a projection of the\n input object or array.\n * Adds new builtin debug(msgs) that works like debug but applies\n a filter on the input before writing to stderr.\n * Adds new builtin scan($re; $flags). Was documented but not\n implemented.\n * Adds new builtin abs to get absolute value. This potentially\n allows the literal value of numbers to be preserved as length\n and fabs convert to float.\n * Allow if without else-branch. When skipped the else-branch\n will be . (identity).\n * Allow use of $binding as key in object literals.\n * Allow dot between chained indexes when using .[\"index\"]\n * Allow dot for chained value iterator .[], .[]?\n * Fix try/catch catches more than it should.\n * Speed up and refactor some builtins, also remove\n scalars_or_empty/0.\n * Now halt and halt_error exit immediately instead of continuing\n to the next input.\n * Fix issue converting string to number after previous convert\n error.\n * Fix issue representing large numbers on some platforms causing\n invalid JSON output.\n * Fix deletion using assigning empty against arrays.\n * Allow keywords to be used as binding name in more places.\n * Allow using nan as NaN in JSON.\n * Expose a module's function names in modulemeta.\n * Fix contains/1 to handle strings with NUL.\n * Fix stderr/0 to output raw text without any decoration.\n * Fix nth/2 to emit empty on index out of range.\n * Fix implode to not assert and instead replace invalid unicode\n codepoints.\n * Fix indices/1 and rindex/1 in case of overlapping matches in\n strings.\n * Fix sub/3 to resolve issues involving global search-and-replace\n (gsub) operations.\n * Fix empty regular expression matches.\n * Fix overflow exception of the modulo operator.\n * Fix string multiplication by 0 (and less than 1) to emit empty\n string.\n * Fix segfault when using libjq and threads.\n * Fix constant folding of division and reminder with zero\n divisor.\n * Fix error/0, error/1 to throw null error.\n * Simpler and faster transpose.\n * Simple and efficient implementation of walk/1.\n * Remove deprecated filters leaf_paths, recurse_down.\n","status":"published","published":"2026-09-17T08:05:35Z","modified":"2026-09-28T18:23:12.243926519Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:2983-1","title":"Security update for jq","description":"This update for jq fixes the following issues:\n\n- CVE-2026-32316: integer overflow within the `jvp_string_append()` and `jvp_string_copy_replace_bad` functions can\n  lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).\n- CVE-2026-33947: unbounded recursion in functions `jv_setpath()`, `jv_getpath()`, and `delpaths_sorted()` can lead to\n  excessive resource consumption when processing crafted JSON input (bsc#1262069).\n- CVE-2026-39956: missing runtime type checks in `_strindices` and `jv_string_indexes()` can lead to a crash when\n  evaluating untrusted jq filters against a release build (bsc#1262070).\n- CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in `jv_parse_sized` can lead to an\n  out-of-bounds read when processing malformed JSON (bsc#1262071).\n- CVE-2026-40164: use of `MurmurHash3` with a hardcoded seed allows pre-computation of key collisions and can lead to a\n  denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).\n","status":"published","published":"2026-07-14T13:19:54Z","modified":"2026-07-15T10:00:08.834160955Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8202-1","title":"jq vulnerabilities","description":"It was discovered that jq did not correctly handle certain string\nconcatenations. An attacker could possibly use this issue to cause a denial\nof service or execute arbitrary code. This issue was addressed in Ubuntu\n16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu\n24.04 LTS and Ubuntu 25.10. (CVE-2026-32316)\n\nIt was discovered that jq did not correctly handle recursion in certain\ncircumstances. An attacker could possibly use this issue to cause a denial\nof service. (CVE-2026-33947)\n\nIt was discovered that jq did not correctly handle improperly terminated\nstrings. An attacker could possibly use this issue to cause a denial of\nservice or execute arbitrary code. This issue was addressed in Ubuntu 16.04\nLTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS\nand Ubuntu 25.10. (CVE-2026-33948)\n\nIt was discovered that jq did not correctly handle checking certain\nvariable types. An attacker could possibly use this issue to cause a denial\nof service or leak sensitive information. This issue was addressed in\nUbuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,\nUbuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-39956)\n\nIt was discovered that jq did not correctly handle certain string\nformatting. An attacker could possibly use this issue to leak sensitive\ninformation or cause a denial of service. (CVE-2026-39979)\n\nIt was discovered that jq used a fixed seed for hash table operations. An\nattacker could possibly use this issue to cause a denial of service. This\nissue was addressed in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04\nLTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-40164)","status":"published","published":"2026-04-23T07:35:38Z","modified":"2026-08-31T17:16:00.927762977Z","updated_at":"2026-11-02T16:58:22.951676Z"},{"id":"USN-8202-2","title":"jq vulnerabilities","description":"USN-8202-1 fixed vulnerabilities in jq. This update provides the\ncorresponding update to Ubuntu 26.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that jq did not correctly handle certain string\n concatenations. An attacker could possibly use this issue to cause a\n denial  of service or execute arbitrary code. (CVE-2026-32316)\n\n It was discovered that jq did not correctly handle recursion in certain\n circumstances. An attacker could possibly use this issue to cause a denial\n of service. (CVE-2026-33947)\n\n It was discovered that jq did not correctly handle improperly terminated\n strings. An attacker could possibly use this issue to cause a denial of\n service or execute arbitrary code. (CVE-2026-33948)\n\n It was discovered that jq did not correctly handle checking certain\n variable types. An attacker could possibly use this issue to cause a\n denial  of service or leak sensitive information. (CVE-2026-39956)\n\n It was discovered that jq did not correctly handle certain string\n formatting. An attacker could possibly use this issue to leak sensitive\n information or cause a denial of service. (CVE-2026-39979)\n\n It was discovered that jq used a fixed seed for hash table operations. An\n attacker could possibly use this issue to cause a denial of service.\n (CVE-2026-40164)","status":"published","published":"2026-04-28T04:18:39Z","modified":"2026-06-30T18:15:53.504445553Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}