jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f Patch
- https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p Exploit, Vendor Advisory
- https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.9 · jqlang, redhatNVD modified 2026-10-26 19:36
Affected (CPE criteria) 28
cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*cpe:2.3:a:redhat:ai_inference_server:*:*:*:*:*:*:*:*cpe:2.3:a:redhat:ansible_automation_platform:2.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:ceph_storage:4.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:codeready_linux_builder:9.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:codeready_linux_builder:10.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:codeready_linux_builder_eus:9.4:*:*:*:*:*:*:*cpe:2.3:a:redhat:codeready_linux_builder_eus:9.6:*:*:*:*:*:*:*cpe:2.3:a:redhat:codeready_linux_builder_eus:10.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_ai:*:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_aus:8.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_aus:8.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:10.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_tus:8.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_tus:8.8:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:*
References 33
- https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f Patch
- https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p Exploit, Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:16252 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:16692 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:16693 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:18040 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:18042 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:18043 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:18044 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:18045 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:18046 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:18047 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:18048 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:19151 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:19365 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:23233 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:23245 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:25044 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:25096 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:25181 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:26528 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:26542 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:28887 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:30078 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:30087 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:30088 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:30089 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:34098 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:8579 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-39979 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2458077 Issue Tracking, Third Party Advisory
- https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p Exploit, Vendor Advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39979.json Third Party Advisory