CVE-2026-39979

Published: April 15, 2026Last modified: June 12, 2026

Description

jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.

Severity score breakdown

Parameter	Value
Base score	6.5
Attack Vector	NETWORK
Attack complexity	LOW
Privileges required	NONE
User interaction	NONE
Scope	UNCHANGED
Confidentiality	LOW
Integrity impact	NONE
Availability impact	LOW
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Status

Product	Release	Package	Status
Alpaquita Linux	23 LTS	jq	Fixed (1.8.1-r1)
	25 LTS	jq	Fixed (1.8.1-r2)
	Stream	jq	Fixed (1.8.1-r1)

CVE-2026-39979

Description

Severity score breakdown

Status

References