Executive brief
jq is a popular command-line tool used for processing and transforming JSON data in automation, data pipelines, and web backends. A vulnerability exists where processing a specially crafted, extremely large file can cause the tool to crash or corrupt its memory. This could allow an attacker to disrupt automated services or potentially gain further unauthorized access to the system running the tool.
Technical details
A heap-based buffer overflow exists in jq's jv_load_file function when using the --rawfile flag. When reading a file larger than approximately 2GB, the jv_string_append_buf function correctly identifies that the string is too long and returns an invalid object state. However, the raw-file loop fails to terminate upon this error, causing subsequent iterations to attempt to append data to the now-invalid object. In builds where assertions are disabled (common in production), this invalid object is misinterpreted as a valid string pointer, leading to an out-of-bounds write. An attacker providing a malicious file can trigger a denial of service or potentially achieve code execution depending on the environment. The issue is fixed in version 1.8.2.
Affected products
- jqlang jq < 1.8.2
Timeline
- 2026-06-08: advisory: GitHub Security Advisory published
- 2026-06-25: disclosed: NVD publication date