CVE-2026-54679: jq Integer Overflow Denial of Service on 32-Bit Systems

Technical summary

CVE-2026-54679 is an integer overflow vulnerability (CWE-190) in jq versions prior to 1.8.2, located in the jvp_string_append function. The flaw manifests on 32-bit architectures when integer arithmetic on string buffer sizes overflows, bypassing heap bounds checks and enabling a subsequent buffer overrun. The overflow occurs during string concatenation operations, allowing an attacker to corrupt heap memory and crash the process. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) reflects local attack surface with user interaction required, limited to availability impact.

Business impact

For organizations relying on jq for automated JSON processing pipelines—particularly data ingestion, API response transformation, or log parsing—this vulnerability introduces availability risk. An attacker with local system access or ability to supply malicious JSON input could trigger a denial of service, interrupting batch jobs or service chains that depend on jq. The impact is contained to the jq process itself and does not cascade to other systems. Organizations with 32-bit deployments face higher exposure; those on 64-bit systems are unaffected.

Affected systems

jq versions before 1.8.2 running on 32-bit systems are vulnerable. This includes legacy deployments, embedded systems, or IoT devices using 32-bit architectures. 64-bit systems are not affected. The vulnerability requires user interaction (passing malicious JSON to jq), narrowing the attack surface to scenarios where jq processes untrusted input.

Exploitability

Exploitation requires local access and the ability to supply malicious JSON input to a vulnerable jq instance on a 32-bit system. An attacker cannot exploit this remotely over a network. The attack surface is limited to environments where jq processes untrusted data, such as web servers that pass user-submitted JSON to jq for processing, or systems that parse JSON from external feeds. The simplicity of the attack (crafting specific JSON) is offset by the strict requirements for 32-bit architecture and local/direct input control.

Remediation

Update jq to version 1.8.2 or later. Patch availability should be verified against the official jq project repository. For systems unable to update immediately, restrict jq's processing to trusted JSON sources, apply input validation, and isolate jq processes to minimize blast radius if a crash occurs. Organizations operating only 64-bit systems may deprioritize this patch, though staying current is recommended.

Patch guidance

Upgrade jq to version 1.8.2 or newer. Verify the patched version through the official jq release channels or your distribution's package repository. For development environments, update build containers and CI/CD base images. For production servers, test the patched version in a staging environment before deployment to ensure compatibility with existing JSON processing scripts. Monitor jq processes post-patch to confirm stability.

Detection guidance

Monitor for jq process crashes on 32-bit systems, especially those processing JSON from external sources. Log analysis should flag repeated jq failures when handled by the same upstream data source, which may indicate attack attempts. Network segmentation and input validation can reduce exposure. Vulnerability scanners configured for 32-bit systems will flag jq versions prior to 1.8.2 during asset inventory scans.

Why prioritize this

This vulnerability warrants prompt attention for 32-bit deployments but is lower priority for 64-bit-only environments. The medium CVSS score (5.5) reflects limited impact scope (availability only, local attack vector). Prioritization should focus on: (1) systems processing untrusted JSON, (2) 32-bit architectures, and (3) environments where jq downtime affects critical pipelines. Organizations on 64-bit systems can schedule updates within normal patch cycles.

Risk score, explained

The CVSS 3.1 score of 5.5 (Medium) balances two factors: high severity of impact when triggered (complete process unavailability, score of 9 for availability), offset by restrictive preconditions (32-bit only, local access, user interaction required). The attack complexity is low once preconditions are met, but the preconditions themselves significantly limit real-world exploitation likelihood for most modern environments.

Frequently asked questions