TI-2026-24844 CVE-2026-32316
jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow
Priority HIGH 75
jq is a command-line JSON processor.
jqlang
Records24All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9
Exploited now
jqlang records in CISA KEVNo jqlang vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
24 records
TI-2025-30431 CVE-2025-48060
AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt)
Priority HIGH 73
jq is a command-line JSON processor.
Priority HIGH 72
jq is a command-line JSON processor.
TI-2023-26962 CVE-2023-49355 · GHSA-4c3j-f924-rc7v
decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via…
Priority HIGH 72
decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" input.
TI-2026-28834 CVE-2026-39979
jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers
Priority HIGH 70
jq is a command-line JSON processor.
TI-2024-35799 CVE-2024-53427 · GHSA-8mxc-vqrq-gcm8
Type confusion in jqlang jq
Priority HIGH 70
decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp…
TI-2026-36743 CVE-2026-49839
jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow
Priority HIGH 66
jq is a command-line JSON processor.
Priority MEDIUM 62
jq is a command-line JSON processor.
TI-2026-31960 CVE-2026-43896
jq: Stack Overflow in Recursive Object Merge
Priority MEDIUM 61
jq is a command-line JSON processor.
TI-2026-31958 CVE-2026-43894
jq: Wild stack write via signed-integer overflow in decNumber D2U() macro
Priority MEDIUM 61
jq is a command-line JSON processor.
TI-2026-26297 CVE-2026-33947
jq: Unbounded Recursion in jv_setpath(), jv_getpath() and delpaths_sorted()
Priority MEDIUM 61
jq is a command-line JSON processor.
TI-2026-28812 CVE-2026-39956
jq: Missing runtime type checks for _strindices lead to crash and limited memory disclosure
Priority MEDIUM 60
jq is a command-line JSON processor.
Priority MEDIUM 58
jq is a command-line JSON processor.
Priority MEDIUM 58
jq is a command-line JSON processor.
Priority MEDIUM 58
jq is a command-line JSON processor.
Priority MEDIUM 58
jq is a command-line JSON processor.
TI-2025-08615 CVE-2025-9403 · GHSA-45r2-rx5v-q5f6
jqlang jq JSON jq_test.c run_jq_tests assertion
Priority MEDIUM 55
A vulnerability was determined in jqlang jq up to 1.6.
TI-2026-31959 CVE-2026-43895
Improper input validation in jqlang jq
Priority MEDIUM 54
jq is a command-line JSON processor.
TI-2026-26298 CVE-2026-33948
jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input
Priority MEDIUM 48
jq is a command-line JSON processor.
Priority LOW 29
jq is a command-line JSON processor.
TI-2026-35267 CVE-2026-47770
jq: stack overflow in deep structural equality
Priority LOW 29
jq is a command-line JSON processor.
Priority LOW 29
jq is a command-line JSON processor.
TI-2023-27495 CVE-2023-50268
jq has stack-based buffer overflow in decNaNs
Priority LOW 28
jq is a command-line JSON processor.
TI-2023-27474 CVE-2023-50246
jq has heap-buffer-overflow vulnerability in the function decToString in decNumber.c
Priority LOW 28
jq is a command-line JSON processor.