Executive brief
jq is a widely used command-line tool and library for processing JSON data. A vulnerability exists where processing specifically crafted, extremely large strings can cause the application to crash or potentially allow for unauthorized memory access. This could lead to service disruptions or system instability in environments that use jq to process untrusted data or queries.
Technical details
An integer overflow vulnerability (CWE-190) exists in jq's string handling functions, specifically jvp_string_append and jvp_string_copy_replace_bad. When concatenating strings that result in a combined length exceeding 2^31 bytes, the 32-bit unsigned integer used for buffer allocation size calculation overflows, leading to a heap-based buffer overflow (CWE-122). An attacker can exploit this by providing a crafted jq query or extremely large JSON input to trigger the overflow during string processing. This can result in a process crash (DoS) or potential heap corruption for further exploitation. The issue is caused by a lack of string size bounds checking and has been addressed in commit e47e56d by enforcing INT_MAX limits on string lengths.
Affected products
- jqlang jq up to and including 1.8.1
Timeline
- 2026-04-12: advisory: GitHub Security Advisory published
- 2026-04-13: disclosed: CVE-2026-32316 published
- 2026-04-13: patched: Fix committed to repository