CVE-2026-49839: jq Heap Buffer Overflow via --rawfile String Handling

Technical summary

The vulnerability resides in jq's jv_load_file() function when invoked with the raw file mode (raw=1). The function accumulates file chunks into a jv string object via repeated jv_string_append_buf() calls. When the accumulated string exceeds the maximum allowed size, jv_string_append_buf() returns jv_invalid_with_msg("String too long") to signal error. The critical flaw is that the raw-file reading loop does not halt upon receiving this error state; if additional bytes remain in the file, the next iteration attempts to append to the already-invalid jv object. In assertion-enabled builds, this triggers an abort in jvp_string_ptr(). In assertion-disabled production builds, the invalid object is misinterpreted as a valid string, leading to out-of-bounds memory writes. This is classified as a heap-buffer-overflow under CWE-787 (Out-of-bounds Write).

Business impact

For organizations using jq in automated JSON processing pipelines, CI/CD workflows, or data transformation scripts, this vulnerability presents a denial-of-service risk if an attacker can supply malformed input files. In environments where jq processes untrusted data (such as log aggregation, API response parsing, or user-uploaded documents), the out-of-bounds write could potentially be leveraged for remote code execution. The impact is heightened in containerized or serverless deployments where jq runs with broad process permissions, and in scenarios where users unknowingly process attacker-controlled JSON files.

Affected systems

jq versions prior to 1.8.2 are vulnerable. This affects all deployments of jqlang/jq on Linux, macOS, and other Unix-like systems where jq is installed as a system utility or embedded in applications. Particular risk applies to systems that automatically or semi-automatically process JSON files from external sources (e.g., APIs, uploads, inter-service data exchange) using the `--rawfile` flag.

Exploitability

The vulnerability requires user interaction: an attacker must supply a crafted oversized file and cause a user or automated process to invoke jq with the `--rawfile` flag on that file. This is a local attack vector (AV:L) with no special privileges required (PR:N), but user involvement in triggering the command is necessary (UI:R). The simplicity of constructing a large, malformed JSON or text file makes the technical barrier to crafting a proof-of-concept low. However, real-world exploitation depends on how jq is integrated into workflows and whether users/systems can be socially engineered or misconfigured to process untrusted input.

Remediation

Upgrade jq to version 1.8.2 or later. This patch corrects the error-handling logic in jv_load_file() to immediately cease file reading when the string-too-long error is detected. After patching, verify the fix in your environment by testing jq with oversized input files to confirm it properly rejects them without crashing or producing unexpected behavior.

Patch guidance

Obtain jq 1.8.2 from the official jqlang/jq repository or your Linux distribution's package manager. Most major distributions have already backported or updated their jq packages; check your vendor's advisory or run `jq --version` to confirm your installed version. For containerized deployments, rebuild images with the patched jq version and redeploy. For development and CI/CD environments, update jq in your build toolchains and container base images. Test JSON processing workflows post-update to ensure no regressions.

Detection guidance

Monitor for jq process crashes or segmentation faults, especially when processing large JSON or text files via `--rawfile`. Review process logs and core dumps for evidence of jvp_string_ptr() assertions or heap-buffer-overflow signals. In networks, observe for unusual jq invocations with atypical file arguments or unexpected process terminations. Conduct a code review of any scripts or applications that call jq with user-supplied or external data sources to identify risk points and enforce input validation independent of jq's built-in limits.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (7.1), the combination of integrity and availability impacts, and the ease of weaponization. While it requires user interaction, jq's prevalence in data processing workflows and the simplicity of constructing exploit input make it a practical threat. Organizations should prioritize patching systems where jq processes any untrusted JSON or large files, particularly in automated pipelines or public-facing services.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects a HIGH severity assessment driven by the out-of-bounds write capability (CWE-787), which enables both integrity compromise (potential code execution) and availability impact (process crashes). The local attack vector and requirement for user interaction lower the score compared to network-based vulnerabilities, but the lack of privilege escalation requirement and the straightforward nature of the exploit scenario maintain a high baseline risk. Organizations without active protections against malicious file processing or those running unpatched jq are at elevated practical risk.

Frequently asked questions