Threat Intelligence Database

jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion (uncontrolled recursion). The crash occurs in jq's recursive structural comparison code, with the recursion repeating through jvp_array_equal() and jv_equal() in src/jv.c when comparing deeply nested arrays; a nearby sort comparator path through jv_cmp() in src/jv_aux.c overflows the stack at a larger nesting depth from the same missing recursion guard. Anyone running jq comparisons on attacker-controlled deeply nested JSON values, or embedding jq in a context where untrusted data can reach the == comparison path, is affected. This vulnerability is fixed in 1.8.2.

jq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds. When jv_load_file(raw=1) reads an attacker-controlled file, it repeatedly appends file chunks to the same jv string accumulator. Once jv_string_append_buf() returns jv_invalid_with_msg("String too long"), the raw-file loop does not stop. If the file contains at least one more byte, the next loop iteration appends a new chunk to an object that is already invalid. With assertions enabled this aborts in jvp_string_ptr(). With assertions disabled, the invalid object is interpreted as a string object and ASan reports heap-buffer-overflow. This vulnerability is fixed in 1.8.2.

jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvp_string_append has a chance of integer/multiple overflowing and then causing a massive buffer overrun. This vulnerability is fixed in 1.8.2.

CVE-2026-43896 is a medium severity vulnerability in jq versions 1.8.1 and earlier caused by uncontrolled recursion in the jv_object_merge_recursive() function. This occurs when using the * operator on two JSON objects, potentially causing a segmentation fault and crashing the jq process. The vulnerability impacts availability but does not affect confidentiality or integrity. No official patch or remediation is currently available. Users should monitor vendor advisories for updates and exercise caution when processing untrusted JSON with affected jq versions.

jq versions 1.8.1 and earlier contain an improper input validation vulnerability related to embedded NUL bytes in import paths. The jq language parser accepts these NUL bytes, but the underlying file path resolution uses C string operations that terminate at the NUL byte, causing a mismatch between the validated import string and the actual file accessed. This discrepancy can lead to unintended file access. The vulnerability has a medium severity with a CVSS score of 4.4. No official patch or remediation has been confirmed at this time.

CVE-2026-43894 is an integer overflow vulnerability in jq versions 1.8.1 and earlier. The vulnerability occurs when processing a very large number literal, causing a signed integer overflow that bypasses heap allocation checks and leads to a large buffer write on the stack with attacker-controlled data. This can result in a denial of service due to stack corruption. No patch or official remediation is currently confirmed.

jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.

CVE-2026-40612 is a medium severity vulnerability in jq (version 1.8.1 and earlier) where the function jv_contains performs uncontrolled recursion into nested JSON arrays or objects without a depth limit. This can lead to exhaustion of the C stack when processing sufficiently deeply nested input structures, causing a denial of service. The vulnerability arises because jq's JSON parser limits nesting depth to 10,000, but programmatically constructed inputs using reduce can exceed this, triggering the recursion issue.

CVE-2026-41257 is a medium severity integer overflow vulnerability in jq, a command-line JSON processor. Versions 1.8.1 and earlier have a flaw in the jq bytecode VM's data stack allocation size tracking, which uses a signed integer. When the stack grows beyond approximately 1 GiB due to deeply nested generator forks, the doubling arithmetic overflows, causing the wrapped value to be passed to realloc and used in a memmove with attacker-controlled offsets. This can lead to memory corruption. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

jq is a command-line JSON processor. Prior to version 1.8.2, the _strindices builtin in jq's src/builtin.c passes its arguments directly to jv_string_indexes() without verifying they are strings, and jv_string_indexes() in src/jv.c relies solely on assert() checks that are stripped in release builds compiled with -DNDEBUG. This allows an attacker to crash jq trivially with input like _strindices(0), and by crafting a numeric value whose IEEE-754 bit pattern maps to a chosen pointer, achieve a controlled pointer dereference and limited memory read/probe primitive. Any deployment that evaluates untrusted jq filters against a release build is vulnerable. This issue has been patched in commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03, which is part of version 1.8.2.