Browse CVEs

MEDIUM 5.5 CVE-2026-54679 jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvp_string_append has a chance of integer/multiple overflowing and then causing… Jq 1.8.2+ Fix from $1,6002026-06-25 HIGH 7.1 CVE-2026-49839 jq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-string error into invalid-state reuse and a real hea… Jq 1.8.2+ Fix from $1,9502026-06-25 MEDIUM 5.5 CVE-2026-47770 jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq'… Jq 1.8.2+ Fix from $1,6002026-06-25 MEDIUM 5.5 CVE-2026-44777 jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two otherwise valid mo… Jq after 1.8.2 Fix from $1,6002026-05-11 MEDIUM 5.5 CVE-2026-43894 jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D… Jq after 1.8.1 Fix from $1,6002026-05-11 MEDIUM 5.5 CVE-2026-43896 jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash th… Jq after 1.8.1 Fix from $1,6002026-05-11 MEDIUM 5.5 CVE-2026-41257 jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack… Jq after 1.8.1 Fix from $1,6002026-05-11 MEDIUM 5.5 CVE-2026-40612 jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects with no depth limit. With a sufficiently n… Jq after 1.8.1 Fix from $1,6002026-05-11 MEDIUM 5.5 CVE-2026-41256 jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL b… Jq after 1.8.1 Fix from $1,6002026-05-11 MEDIUM 5.3 CVE-2026-33948 jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows v… Jq 2026-04-12+ Fix from $1,6002026-04-14 MEDIUM 6.5 CVE-2026-39979 jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted … Jq 2026-04-12+ Fix from $1,6002026-04-13 MEDIUM 6.1 CVE-2026-39956 jq is a command-line JSON processor. In commits after 69785bf77f86e2ea1b4a20ca86775916889e91c9, the _strindices builtin in jq's src/builtin.c passes … Jq 2026-04-08+ Fix from $1,6002026-04-13 MEDIUM 5.5 CVE-2026-33947 jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(), and delpaths_sorted() in jq's src/jv_aux.c us… Jq after 1.8.1 Fix from $1,6002026-04-13 HIGH 7.5 CVE-2026-32316 jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_cop… Jq after 1.8.1 Fix from $1,9502026-04-13 MEDIUM 5.5 CVE-2025-9403 A vulnerability was determined in jqlang jq up to 1.6. Impacted is the function run_jq_tests of the file jq_test.c of the component JSON Parser. Exec… Jq after 1.6 Fix from $1,6002025-08-25 HIGH 7.5 CVE-2025-48060 jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_… Jq after 1.7.1 Fix from $1,9502025-05-21 MEDIUM 6.5 CVE-2024-23337 jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483… Jq after 1.7.1 Fix from $1,6002025-05-21 HIGH 8.1 CVE-2024-53427 decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buf… Jq after 1.7.1 Fix from $1,9502025-02-26 MEDIUM 5.5 CVE-2023-50268 jq is a command-line JSON processor. Version 1.7 is vulnerable to stack-based buffer overflow in builds using decNumber. Version 1.7.1 contains a pat… Jq Patch available Fix from $1,6002023-12-13 MEDIUM 5.5 CVE-2023-50246 jq is a command-line JSON processor. Version 1.7 is vulnerable to heap-based buffer overflow. Version 1.7.1 contains a patch for this issue. Jq Patch available Fix from $1,6002023-12-13 HIGH 7.5 CVE-2023-49355 decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" input. NOTE: this is not the same… Jq Patch available Fix from $1,9502023-12-11