By vendor

Jqlang vulnerabilities

Known CVEs affecting Jqlang products, prioritized by severity, with SEC.co remediation and detection guidance.

3 published vulnerabilities

• CVE-2026-49839HIGH 7.1

  jq is a widely-used command-line tool for processing JSON data. This vulnerability exists in how jq handles very large files when using the `--rawfile` option. When jq reads an oversized file, it is supposed to stop and report an error once the file exceeds the string size limit. However, in versions before 1.8.2, the error handling is incomplete: the tool continues trying to read more data from the file even after detecting it is too large. This causes jq to write data to memory locations it shouldn't access, potentially leading to a crash or allowing an attacker to execute code. An attacker would need to trick a user into running jq on a specially crafted large file.

• CVE-2026-47770MEDIUM 5.5

  jq, a widely-used command-line tool for processing and querying JSON data, contains a denial-of-service vulnerability in versions before 1.8.2. When comparing two deeply nested JSON arrays using the == operator, jq crashes due to stack exhaustion. An attacker can trigger this crash by supplying specially crafted nested JSON structures, either directly via command-line input or through embedded jq usage in applications. The crash leaves no data corruption or security breach—just service unavailability. This is a local or user-interaction vulnerability, not remotely exploitable on its own, but it can disrupt any workflow or service relying on jq to process untrusted JSON.

• CVE-2026-54679MEDIUM 5.5

  jq, a widely-used command-line tool for processing JSON data, contains an integer overflow vulnerability in its string-handling code that only affects 32-bit systems. When processing specially crafted input, the vulnerable jvp_string_append function can miscalculate buffer sizes, leading to a buffer overrun that crashes the application. Version 1.8.2 and later contain the fix. This is primarily a local denial-of-service risk; the vulnerability does not compromise data confidentiality or integrity.