Jqlang vulnerabilities

Products

• Jq 24

Newest

• jqlang jq jq: potential integer overflow in jvp_string_append CVE-2026-54679 Fix available 6.9 MediumJune 25, 2026
• jqlang jq jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow CVE-2026-49839 Fix available 7.1 HighJune 13, 2026
• jqlang jq jq: stack overflow in deep structural equality CVE-2026-47770 Fix available 6.8 MediumMay 29, 2026
• jqlang jq jq: Stack Overflow in Recursive Object Merge CVE-2026-43896 Fix available 6.2 MediumMay 11, 2026
• jqlang jq jq: Embedded NUL in jq import paths causes local redaction-policy bypass and preserves sensitive fields in published artifacts CVE-2026-43895 Fix available 4.4 MediumMay 11, 2026
• jqlang jq jq: stack overflow in module loading on mutual `include` CVE-2026-44777 Fix available 5.4 MediumMay 11, 2026
• jqlang jq jq: Wild stack write via signed-integer overflow in decNumber D2U() macro CVE-2026-43894 Fix available 6.2 MediumMay 11, 2026
• jqlang jq jq: Embedded NUL truncates top-level jq programs loaded with -f CVE-2026-41256 Fix available 5.5 MediumMay 11, 2026
• jqlang jq jq: Stack overflow via unbounded recursion in jv_contains CVE-2026-40612 Fix available 5.4 MediumMay 11, 2026
• jqlang jq jq: Signed-int overflow in `stack_reallocate` (jq VM stack) CVE-2026-41257 Fix available 6.4 MediumMay 11, 2026
• jqlang jq jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input CVE-2026-33948 Fix available 2.9 LowApril 13, 2026
• jqlang jq, red hat ai inference server 3.2, ai inference server 3.3 +24 more +26 more jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seed CVE-2026-40164 Fix available 7.5 HighApril 13, 2026
• jqlang jq, red hat ai inference server 3.2, ai inference server 3.3 +38 more +40 more jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers CVE-2026-39979 Fix available 6.9 MediumApril 13, 2026
• jqlang jq jq: Missing runtime type checks for _strindices lead to crash and limited memory disclosure CVE-2026-39956 Fix available 6.1 MediumApril 13, 2026
• jqlang jq jq: Unbounded Recursion in jv_setpath(), jv_getpath() and delpaths_sorted() CVE-2026-33947 Fix available 6.2 MediumApril 13, 2026
• jqlang jq jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow CVE-2026-32316 Fix available 8.2 HighApril 13, 2026
• jqlang jq jqlang jq JSON jq_test.c run_jq_tests assertion CVE-2025-9403 Fix available 4.8 MediumAugust 25, 2025
• jqlang jq jq heap use after free vulnerability in f_strflocaltime CVE-2025-49014 Fix available 5.5 MediumJune 19, 2025
• jqlang jq AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) CVE-2025-48060 Public exploitFix available 7.7 HighMay 21, 2025
• jqlang jq jq has signed integer overflow in jv.c:jvp_array_write CVE-2024-23337 Fix available 4.3 MediumMay 21, 2025
• jqlang jq jq v1.7.1 contains a stack-buffer-overflow in the decNumberCopy function within decNumber.c. CVE-2024-53427 Fix available 8.1 HighFebruary 26, 2025
• jqlang jq jq has stack-based buffer overflow in decNaNs CVE-2023-50268 Fix available 6.2 MediumDecember 13, 2023
• jqlang jq jq has heap-buffer-overflow vulnerability in the function decToString in decNumber.c CVE-2023-50246 Fix available 6.2 MediumDecember 13, 2023
• jqlang jq decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " [... CVE-2023-49355 Fix available 7.5 HighDecember 11, 2023