Search: CVE-2026-33948

jq versions prior to commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where input parsing improperly handles embedded NUL bytes. The tool uses strlen() instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and only validate the prefix as JSON. This allows attackers to craft inputs with a valid JSON prefix followed by malicious trailing data that jq ignores but downstream consumers may process. This vulnerability has been patched in the specified commit.