Junglewise Threat Intelligence

CVE-2026-39979: jqlang jq out-of-bounds read in jv_parse_sized

CVE-2026-39979 · Severity: medium · CVSS 6.5 · Published 2026-04-13

Technologies: Jqlang Jq, Red Hat Enterprise Linux 8. Vendors: Jqlang, Red Hat.

Executive brief

jq is a widely used tool and library for processing JSON data. A security flaw was found in how the library handles malformed data when reporting errors. If an application uses this library to process untrusted data, an attacker could potentially crash the application or view small amounts of sensitive information from the computer's memory.

Technical details

An out-of-bounds read vulnerability exists in libjq's jv_parse_sized() API. While the API accepts a counted buffer with an explicit length, the error-handling path in jv_parse_sized_custom_flags() uses jv_string_fmt() with a %s format specifier to process the input buffer. This causes the underlying vsnprintf() to read past the intended buffer length until a NUL terminator is encountered. An attacker providing malformed JSON in a non-NUL-terminated buffer can trigger this OOB read, potentially resulting in information disclosure or a denial-of-service (crash). The issue is fixed in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f and jq version 1.8.2.

Affected products

  • jqlang jq <= 1.8.1
  • Red Hat Red Hat Enterprise Linux 8 1.6-12.el8_10

Timeline

  • 2026-04-13: advisory: GitHub Security Advisory GHSA-2hhh-px8h-355p published
  • 2026-04-13: patched: Fix committed to jqlang/jq repository
  • 2026-05-12: patched: Red Hat released security updates for RHEL 8

References

Related threats