Log in Start free

Vulnerability · Published Apr 13, 2026 · Assigned by GitHub_M

CVE-2026-39979jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers

High 8.2

In plain English

A high-severity out-of-bounds read in jq from jqlang. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.6%top 53.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10jq1.7.1-11.el10_2.2ALSA-2026:19151
AlmaLinux:10jq1.7.1-11.el10_1.0.2ALSA-2026:16692
AlmaLinux:8jq1.6-12.el8_10ALSA-2026:16252
AlmaLinux:9jq1.6-19.el9_8.2ALSA-2026:19365
AlmaLinux:9jq1.6-19.el9_7.0.2ALSA-2026:16693
AlmaLinux:10jq-devel1.7.1-11.el10_1.0.2ALSA-2026:16692
AlmaLinux:10jq-devel1.7.1-11.el10_2.2ALSA-2026:19151
AlmaLinux:8jq-devel1.6-12.el8_10ALSA-2026:16252
AlmaLinux:9jq-devel1.6-19.el9_8.2ALSA-2026:19365
AlmaLinux:9jq-devel1.6-19.el9_7.0.2ALSA-2026:16693
Alpine:v3.22jq1.8.2-r0ALPINE-CVE-2026-39979
Alpine:v3.23jq1.8.2-r0ALPINE-CVE-2026-39979
Alpine:v3.24jq1.8.2-r0ALPINE-CVE-2026-39979
Debian:12jq1.6-2.1+deb12u2DEBIAN-CVE-2026-39979
Debian:13jq1.7.1-6+deb13u2DEBIAN-CVE-2026-39979
Debian:14jq1.8.1-5DEBIAN-CVE-2026-39979
Rocky Linux:10jq0:1.7.1-11.el10_1.0.2RLSA-2026:16692
Rocky Linux:10jq0:1.7.1-11.el10_2.2RLSA-2026:19151
Rocky Linux:8jq0:1.6-12.el8_10RLSA-2026:16252
Rocky Linux:9jq0:1.6-19.el9_8.2RLSA-2026:19365
Rocky Linux:9jq0:1.6-19.el9_7.0.2RLSA-2026:16693
Ubuntu:22.04:LTSjq1.6-2.1ubuntu3.2UBUNTU-CVE-2026-39979
Ubuntu:22.04:LTSjq1.6-2.1ubuntu3.2USN-8202-1
Ubuntu:24.04:LTSjq1.7.1-3ubuntu0.24.04.2UBUNTU-CVE-2026-39979
Ubuntu:24.04:LTSjq1.7.1-3ubuntu0.24.04.2USN-8202-1
Ubuntu:25.10jq1.8.1-3ubuntu1.1USN-8202-1
Ubuntu:25.10jq1.8.1-3ubuntu1.1UBUNTU-CVE-2026-39979
Ubuntu:26.04:LTSjq1.8.1-4ubuntu2UBUNTU-CVE-2026-39979

Affected products (as reported)

VendorProductVersions
jqlang jq < 2f09060afab23fe9390cce7cb860b10416e1bf5f

Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

References