Critical jq Vulnerability: Out-of-Bounds Read and Denial of Service
Summary
ALSA-2026:16693: Important: jq security update. Affects jq versions < 1.6-19.el9_7.0.2. Fixed in 1.6-19.el9_7.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jq is a lightweight and flexible command-line JSON processor that allows users to slice, filter, map, and transform structured JSON data with ease. It is widely used for manipulating JSON data in various applications due to its powerful features and simplicity. However, recent vulnerabilities have been identified that could compromise its security and reliability.
Vulnerability Detail
The vulnerabilities in jq stem from an out-of-bounds read in the function jv_parse_sized(), which can occur when formatting errors arise for non-NUL-terminated buffers. This can lead to potential information leaks. Additionally, a crafted JSON object can cause hash collisions, resulting in a Denial of Service (DoS) condition. These vulnerabilities can be exploited by malicious users to disrupt services or access sensitive data.
How To Fix
Minimum fixed version
1.6-19.el9_7.0.2
This is the first release that contains the fix.
sudo dnf update jqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted JSON data with jq until the update has been applied. This can help mitigate the risk of exploitation while you prepare to update the software.
Conclusion
In summary, the jq package has critical vulnerabilities that can lead to serious security issues, including information leaks and Denial of Service attacks. It is crucial to update to the latest patched version to ensure the security and reliability of your applications.
See every vulnerability recorded for jq →
FAQ
jq is a command-line tool for processing JSON data, allowing users to manipulate and transform JSON structures easily.
The vulnerabilities include an out-of-bounds read and a Denial of Service via crafted JSON objects that cause hash collisions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
As a temporary measure, avoid processing untrusted JSON data with jq until you can apply the necessary updates.
For more details, refer to the CVE pages listed in the related section of the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for jq.
