JQ
Product
jq
23
CVEs
0
On KEV
8.1
Max CVSS
0
New 30D
Severity mix
Critical 0High 6Medium 17Low 0
Watch
Add jq to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-39979 | 6.5 | Apr 13 | jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers Affected: < 2f09060afab23fe9390cce7cb860b10416e1bf5f |
| CVE-2024-23337 | 6.5 | May 21 | jq is a command-line JSON processor Affected: through 1.7.1 |
| CVE-2026-39956 | 6.1 | Apr 13 | jq: Missing runtime type checks for _strindices lead to crash and limited memory disclosure Affected: < 1.8.2 |
| CVE-2026-47770 | 5.5 | Jun 25 | jq: stack overflow in deep structural equality Affected: < 1.8.2 |
| CVE-2026-54679 | 5.5 | Jun 25 | jq: potential integer overflow in jvp_string_append Affected: < 1.8.2 |
| CVE-2026-43896 | 5.5 | May 11 | jq: Stack Overflow in Recursive Object Merge Affected: <= 1.8.1 |
| CVE-2026-44777 | 5.5 | May 11 | jq: stack overflow in module loading on mutual `include` Affected: <= 1.8.2rc1 |
| CVE-2026-43894 | 5.5 | May 11 | jq: Wild stack write via signed-integer overflow in decNumber D2U() macro Affected: <= 1.8.1 |
| CVE-2026-41256 | 5.5 | May 11 | jq: Embedded NUL truncates top-level jq programs loaded with -f Affected: <= 1.8.1 |
| CVE-2026-40612 | 5.5 | May 11 | jq: Stack overflow via unbounded recursion in jv_contains Affected: <= 1.8.1 |
| CVE-2026-41257 | 5.5 | May 11 | jq: Signed-int overflow in `stack_reallocate` (jq VM stack) Affected: <= 1.8.1 |
| CVE-2026-33947 | 5.5 | Apr 13 | jq: Unbounded Recursion in jv_setpath(), jv_getpath() and delpaths_sorted() Affected: < fb59f1491058d58bdc3e8dd28f1773d1ac690a1f |
| CVE-2025-9403 | 5.5 | Aug 25 | A vulnerability was determined in jqlang jq up to 1.6 Affected: through 1.6 |
| CVE-2023-50268 | 5.5 | Dec 13 | jq is a command-line JSON processor Affected: 1.7 |
| CVE-2023-50246 | 5.5 | Dec 13 | jq is a command-line JSON processor Affected: 1.7; 1.7; 1.7 |
| CVE-2026-33948 | 5.3 | Apr 13 | jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input Affected: < 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b |
| CVE-2026-43895 | 4.4 | May 11 | jq: Embedded NUL in jq import paths causes local redaction-policy bypass and preserves sensitive fields in published artifacts Affected: <= 1.8.1 |
Showing 17
