Critical jq Vulnerability: Out-of-Bounds Read and Denial of Service Risks
Summary
ALSA-2026:16252: Important: jq security update. Affects jq versions < 1.6-12.el8_10. Fixed in 1.6-12.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jq is a lightweight and flexible command-line JSON processor, akin to sed for JSON data. It allows users to slice, filter, map, or transform structured data with ease, similar to how sed, awk, or grep manipulate text. This versatility makes jq a popular tool among developers for handling JSON data in various applications. However, recent vulnerabilities have raised concerns about its security, particularly regarding out-of-bounds reads and denial of service attacks.
Vulnerability Detail
The vulnerabilities in jq stem from two main issues: an out-of-bounds read in the function jv_parse_sized() when formatting errors for non-NUL-terminated buffers (CVE-2026-39979) and a denial of service vulnerability caused by crafted JSON objects that lead to hash collisions (CVE-2026-40164). These vulnerabilities can potentially allow attackers to exploit jq in ways that compromise system integrity and availability, leading to unexpected behavior or crashes.
How To Fix
Minimum fixed version
1.6-12.el8_10
This is the first release that contains the fix.
sudo dnf update jqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted JSON data that may trigger these vulnerabilities until the update is applied. Additionally, validating JSON inputs before processing can help mitigate risks.
Conclusion
The jq vulnerabilities present significant risks that can affect system integrity and availability. It is crucial for users to update their jq and jq-devel packages to the latest patched version to mitigate these risks. Employing best practices in data handling and utilizing tools like Vulert can further enhance security.
See every vulnerability recorded for jq →
FAQ
jq is a command-line tool for processing JSON data, allowing users to manipulate and transform structured data easily.
The vulnerabilities include an out-of-bounds read and a denial of service caused by crafted JSON objects leading to hash collisions.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
As a workaround, avoid processing untrusted JSON data and validate inputs to mitigate risks until an update can be applied.
For detailed information, refer to the CVE pages: CVE-2026-39979 and CVE-2026-40164.
Related vulnerabilities
Recent vulnerabilities recorded for jq.
