Is CVE-2026-32316 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-32316 being exploited in the wild.

How severe is CVE-2026-32316?

High severity, with a CVSS score of 8.2, published 13 April 2026.

Which products and versions are affected?

jqlang jq up to and including 1.8.1.

Is there a fix for CVE-2026-32316?

A patch was published on 2026-04-13: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-32316 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-32316?

Check whether you run Jqlang Jq. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32316: jqlang jq heap buffer overflow in string processing functions

CVE-2026-32316 · Severity: high · CVSS 8.2 · Published 2026-04-13

jq is a widely used command-line tool and library for processing JSON data. A vulnerability exists where processing specifically crafted, extremely large strings can cause the application to crash or potentially allow for unauthorized memory access. This could lead to service disruptions or system instability in environments that use jq to process untrusted data or queries.

Technologies: Jqlang Jq. Vendors: Jqlang.

Quick answers

Is CVE-2026-32316 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-32316 being exploited in the wild.
How severe is CVE-2026-32316?: High severity, with a CVSS score of 8.2, published 13 April 2026.
Which products and versions are affected?: jqlang jq up to and including 1.8.1.
Is there a fix for CVE-2026-32316?: A patch was published on 2026-04-13: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32316 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-32316?: Check whether you run Jqlang Jq. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow vulnerability (CWE-190) exists in jq's string handling functions, specifically jvp_string_append and jvp_string_copy_replace_bad. When concatenating strings that result in a combined length exceeding 2^31 bytes, the 32-bit unsigned integer used for buffer allocation size calculation overflows, leading to a heap-based buffer overflow (CWE-122). An attacker can exploit this by providing a crafted jq query or extremely large JSON input to trigger the overflow during string processing. This can result in a process crash (DoS) or potential heap corruption for further exploitation. The issue is caused by a lack of string size bounds checking and has been addressed in commit e47e56d by enforcing INT_MAX limits on string lengths.

Affected products

jqlang jq up to and including 1.8.1

Timeline

2026-04-12: advisory: GitHub Security Advisory published
2026-04-13: disclosed: CVE-2026-32316 published
2026-04-13: patched: Fix committed to repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.