Read the docs
TI-2026-28834 Aliases CVE-2026-39979

jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers

Priority HIGH 70CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · Low
Fix status
Partial Red Hat: 33 fixed, 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0056 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial jq (jqlang): 2f09060afab23fe9390cce7cb860b10416e1bf5fRed Hat: 28 advisoriesRed Hat: 33 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jqlangjqbefore 2f09060afab23fe9390cce7cb860b10416e1bf5f2f09060afab23fe9390cce7cb860b10416e1bf5fPatch availableCNA
  • jq Vendorjqlang Affected before 2f09060afab23fe9390cce7cb860b10416e1bf5f Fixed in 2f09060afab23fe9390cce7cb860b10416e1bf5f Patch available CNA

CPE configurations NVD · 28

CPEVersionsRoleVendor
cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*before 1.8.2Vulnerablejqlang
cpe:2.3:a:redhat:ai_inference_server:*:*:*:*:*:*:*:*3.2.0 to before 3.2.2; 3.3.0 to before 3.3.5VulnerableRed Hat
cpe:2.3:a:redhat:ansible_automation_platform:2.0:*:*:*:*:*:*:*2.0VulnerableRed Hat
cpe:2.3:a:redhat:ceph_storage:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:a:redhat:codeready_linux_builder:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
cpe:2.3:a:redhat:codeready_linux_builder:10.0:*:*:*:*:*:*:*10.0VulnerableRed Hat
cpe:2.3:a:redhat:codeready_linux_builder_eus:9.4:*:*:*:*:*:*:*9.4VulnerableRed Hat
cpe:2.3:a:redhat:codeready_linux_builder_eus:9.6:*:*:*:*:*:*:*9.6VulnerableRed Hat
cpe:2.3:a:redhat:codeready_linux_builder_eus:10.0:*:*:*:*:*:*:*10.0VulnerableRed Hat
  • cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:* Versions before 1.8.2 Vulnerable ·jqlang
  • cpe:2.3:a:redhat:ai_inference_server:*:*:*:*:*:*:*:* Versions 3.2.0 to before 3.2.2; 3.3.0 to before 3.3.5 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ansible_automation_platform:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ceph_storage:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:codeready_linux_builder:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:codeready_linux_builder:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:codeready_linux_builder_eus:9.4:*:*:*:*:*:*:* Versions 9.4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:codeready_linux_builder_eus:9.6:*:*:*:*:*:*:* Versions 9.6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:codeready_linux_builder_eus:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Red Hat
Show 18 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:openshift_ai:*:*:*:*:*:*:*:*3.4 to before 3.4.3VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*4.12 to before 4.12.92; 4.13 to before 4.13.68; 4.14 to before 4.14.68; 4.15 to before 4.15.65; 4.16 to before 4.16.64; 4.17 to before 4.17.55; 4.18 to before 4.18.44; 4.19 to before 4.19.33VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*10.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_aus:8.4:*:*:*:*:*:*:*8.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_aus:8.6:*:*:*:*:*:*:*8.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*8.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*9.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:*9.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:10.0:*:*:*:*:*:*:*10.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_tus:8.6:*:*:*:*:*:*:*8.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_tus:8.8:*:*:*:*:*:*:*8.8VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*8.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:*8.8VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:*9.2VulnerableRed Hat
  • cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_ai:*:*:*:*:*:*:*:* Versions 3.4 to before 3.4.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* Versions 4.12 to before 4.12.92; 4.13 to before 4.13.68; 4.14 to before 4.14.68; 4.15 to before 4.15.65; 4.16 to before 4.16.64; 4.17 to before 4.17.55; 4.18 to before 4.18.44; 4.19 to before 4.19.33 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_aus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_aus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:* Versions 9.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:* Versions 9.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_tus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_tus:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat

Remediation

  • Fix · CNA jq (jqlang) Fixed in 2f09060afab23fe9390cce7cb860b10416e1bf5f

Red Hat 28 advisories

  • RHSA-2026:74674 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (Neuron)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:34098 Released 2026-07-09 · Red Hat rating Critical
    OpenShift Container Platform 4.17.55 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 rhcos-aarch64-417.94.202606250942-0, rhcos-ppc64le-417.94.202606250942-0, rhcos-s390x-417.94.202606250942-0 +1
  • RHSA-2026:28887 Released 2026-07-01 · Red Hat rating Critical
    OpenShift Container Platform 4.14.68 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 rhcos-aarch64-414.92.202606231112-0, rhcos-ppc64le-414.92.202606231112-0, rhcos-s390x-414.92.202606231112-0 +1
Show 25 more Red Hat advisories
  • RHSA-2026:30089 Released 2026-06-25 · Red Hat rating Critical
    Red Hat AI Inference Server 3.3.5 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:30088 Released 2026-06-25 · Red Hat rating Critical
    Red Hat AI Inference Server 3.3.5 (ROCm)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:30087 Released 2026-06-25 · Red Hat rating Critical
    Red Hat AI Inference Server 3.3.5 (Spyre)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-spyre-rhel9
  • RHSA-2026:30078 Released 2026-06-25 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.3.5 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:26542 Released 2026-06-25 · Red Hat rating Critical
    OpenShift Container Platform 4.13.68 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 rhcos-x86_64-413.92.202606160406-0
  • RHSA-2026:26528 Released 2026-06-25 · Red Hat rating Critical
    OpenShift Container Platform 4.12.92 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 rhcos-x86_64-412.86.202606140301-0
  • RHSA-2026:25044 Released 2026-06-18 · Red Hat rating Important
    OpenShift Container Platform 4.16.64 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 rhcos-aarch64-416.94.202606051757-0, rhcos-ppc64le-416.94.202606051757-0, rhcos-s390x-416.94.202606051757-0 +1
  • RHSA-2026:25181 Released 2026-06-17 · Red Hat rating Critical
    OpenShift Container Platform 4.18.44 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 rhcos-aarch64-418.94.202606051320-0, rhcos-ppc64le-418.94.202606051320-0, rhcos-s390x-418.94.202606051320-0 +1
  • RHSA-2026:23233 Released 2026-06-11 · Red Hat rating Important
    OpenShift Container Platform 4.15.65 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 rhcos-aarch64-415.92.202606030318-0, rhcos-ppc64le-415.92.202606030318-0, rhcos-s390x-415.92.202606030318-0 +1
  • RHSA-2026:25096 Released 2026-06-10 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.2 (cuda)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:23245 Released 2026-06-10 · Red Hat rating Important
    OpenShift Container Platform 4.19.33 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 rhcos-aarch64-4.19.9.6.202606031700-0, rhcos-ppc64le-4.19.9.6.202606031700-0, rhcos-s390x-4.19.9.6.202606031700-0 +1
  • RHSA-2026:19365 Released 2026-05-19 · Red Hat rating Important
    jq security update
    • Red Hat Enterprise Linux BaseOS (v. 9) jq-1.6-19.el9_8.2
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) jq-devel-1.6-19.el9_8.2
  • RHSA-2026:19151 Released 2026-05-19 · Red Hat rating Important
    jq security update
    • Red Hat Enterprise Linux BaseOS (v. 10) jq-1.7.1-11.el10_2.2
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) jq-devel-1.7.1-11.el10_2.2
  • RHSA-2026:18043 Released 2026-05-18 · Red Hat rating Important
    jq security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) jq-devel-1.6-16.el9_4.2
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) jq-1.6-16.el9_4.2
  • RHSA-2026:18047 Released 2026-05-18 · Red Hat rating Important
    jq security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) jq-1.6-3.el8_6.2
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) jq-1.6-3.el8_6.2
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) jq-1.6-3.el8_6.2
  • RHSA-2026:18042 Released 2026-05-18 · Red Hat rating Important
    jq security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) jq-devel-1.6-17.el9_6.4
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) jq-1.6-17.el9_6.4
  • RHSA-2026:18040 Released 2026-05-18 · Red Hat rating Important
    jq security update
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) jq-1.7.1-8.el10_0.3
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) jq-devel-1.7.1-8.el10_0.3
  • RHSA-2026:18048 Released 2026-05-18 · Red Hat rating Important
    jq security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) jq-1.5-12.el8_4.5
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) jq-1.5-12.el8_4.5
  • RHSA-2026:18044 Released 2026-05-18 · Red Hat rating Important
    jq security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) jq-1.6-15.el9_2.3
  • RHSA-2026:18046 Released 2026-05-18 · Red Hat rating Important
    jq security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) jq-1.6-6.el8_8.4
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) jq-1.6-6.el8_8.4
  • RHSA-2026:18045 Released 2026-05-18 · Red Hat rating Important
    jq security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) jq-1.6-12.el9_0.3
  • RHSA-2026:16693 Released 2026-05-13 · Red Hat rating Important
    jq security update
    • Red Hat Enterprise Linux BaseOS (v. 9) jq-1.6-19.el9_7.0.2
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) jq-devel-1.6-19.el9_7.0.2
  • RHSA-2026:16692 Released 2026-05-13 · Red Hat rating Important
    jq security update
    • Red Hat Enterprise Linux BaseOS (v. 10) jq-1.7.1-11.el10_1.0.2
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) jq-devel-1.7.1-11.el10_1.0.2
  • RHSA-2026:16252 Released 2026-05-12 · Red Hat rating Important
    jq security update
    • Red Hat Enterprise Linux AppStream (v. 8) jq-1.6-12.el8_10
    • Red Hat Enterprise Linux CRB (v. 8) jq-devel-1.6-12.el8_10
  • RHSA-2026:8579 Released 2026-04-16 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images jq-1.8.1-3.hum1@aarch64, jq-1.8.1-3.hum1@src, jq-1.8.1-3.hum1@x86_64 +2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Ceph Storage 4AffectedNo fix yet: Fix deferred
Red Hat AI Inference Server 3.2Fixed RHSA-2026:25096
Red Hat AI Inference Server 3.3Fixed RHSA-2026:30078, RHSA-2026:30087, RHSA-2026:30088, RHSA-2026:30089
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2026:18043
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:18042
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:16252
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:18048
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:18047
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2026:18047
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:18046
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:18045
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:18044
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:18048
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2026:18047
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:18046
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:16692, RHSA-2026:19151
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:16693, RHSA-2026:19365
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:18040
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2026:18043
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:18042
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:16252
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:16692, RHSA-2026:19151
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:16693, RHSA-2026:19365
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:18040
Red Hat Hardened ImagesFixed RHSA-2026:8579
Red Hat OpenShift AI 3.4Fixed RHSA-2026:74674
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:26528
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2026:26542
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2026:28887
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2026:23233
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:25044
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:34098
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:25181
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:23245
Not affected: 1 product
  • Red Hat Ansible Automation Platform 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-39979
  2. 2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

Patch 1

Advisory 30

  • TI-2026-24844 jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow CVSS 3.1HIGH 8.2
  • TI-2025-30431 AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) CVSS 4.0HIGH 7.7
  • TI-2023-26962 decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via… CVSS 3.1HIGH 7.5
  • TI-2024-35799 Type confusion in jqlang jq CVSS 3.1HIGH 8.1
  • TI-2026-36743 jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow CVSS 3.1HIGH 7.1
  • TI-2024-15439 jq has signed integer overflow in jv.c:jvp_array_write CVSS 3.1MEDIUM 6.5
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences