Executive brief
jq is a widely used command-line tool for processing and transforming JSON data. A vulnerability in how it handles extremely large numbers (over 2 billion digits) can cause the program to crash or behave unpredictably. This could be used by an attacker to disrupt automated workflows or services that process untrusted data using jq.
Technical details
A signed integer overflow exists in the D2U() macro within the bundled decNumber library (vendor/decNumber/decNumber.c). When decNumberFromString is passed a number literal containing INT_MAX-1 digits, the macro's arithmetic overflows, resulting in a negative value. This negative value bypasses heap-allocation size checks, causing the function to use a small stack buffer while attempting to write approximately 1.4 GiB of attacker-controlled data to an offset far below the stack frame. While raw JSON parsing is protected by separate length limits, the vulnerability is reachable via the 'tonumber' function on strings generated within jq. This typically results in a denial of service (crash), though memory corruption is possible depending on the system's memory layout.
Affected products
- jqlang jq <= 1.8.1
Timeline
- 2026-05-06: advisory: GitHub Security Advisory published
- 2026-05-11: disclosed: CVE-2026-43894 published to NVD