Critical Security Flaw in jq Package: Out-of-Bounds Read and Denial of Service Vulnerabilities
Summary
RLSA-2026:16692: Important: jq security update. Affects jq versions < 0:1.7.1-11.el10_1.0.2. Fixed in 0:1.7.1-11.el10_1.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jq is a lightweight and flexible command-line JSON processor that allows users to slice, filter, map, and transform structured data with ease. It is widely used for manipulating JSON data in various applications due to its powerful features and simplicity. However, jq has recently been identified as vulnerable to critical security issues that could compromise system integrity and availability.
Vulnerability Detail
The vulnerabilities in jq stem from an out-of-bounds read in the function jv_parse_sized(), which occurs when formatting errors arise for non-NUL-terminated buffers. This can lead to unintended memory access, potentially exposing sensitive data. Additionally, a crafted JSON object can cause hash collisions, resulting in a Denial of Service (DoS) attack, where the application becomes unresponsive. These vulnerabilities are classified under CVE-2026-39979 and CVE-2026-40164, with a CVSS score of 8.2, indicating a high severity level.
How To Fix
Minimum fixed version
0:1.7.1-11.el10_1.0.2
This is the first release that contains the fix.
sudo dnf update jqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid processing untrusted JSON data that may trigger these vulnerabilities. Additionally, implementing input validation to ensure that JSON objects are well-formed can help mitigate the risk until the package is updated.
Conclusion
The jq package has been identified with critical vulnerabilities that could lead to severe security risks, including data exposure and Denial of Service attacks. It is crucial for users to update to the latest patched version to mitigate these risks and ensure the security of their applications.
See every vulnerability recorded for jq →
FAQ
jq is a command-line tool designed for processing JSON data, allowing users to manipulate and transform JSON structures easily.
The vulnerabilities include an out-of-bounds read that can expose sensitive data and a Denial of Service attack caused by crafted JSON objects leading to hash collisions.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, you can check for vulnerabilities in real-time.
The CVSS score for the vulnerabilities in jq is 8.2, indicating a high level of severity.
Using tools like Vulert, you can monitor your applications for open-source vulnerabilities without needing to access the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for jq.
