JQ
Product
jq
by jqlang · last CVE Jun 25, 2026
23
CVEs
0
On KEV
8.1
Max CVSS
0
New 30D
Severity mix
Critical 0High 6Medium 17Low 0
Watch

Add jq to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-39979
6.5
1%
Apr 13
jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers
Affected: < 2f09060afab23fe9390cce7cb860b10416e1bf5f
CVE-2024-23337
6.5
0%
May 21
jq is a command-line JSON processor
Affected: through 1.7.1
CVE-2026-39956
6.1
0%
Apr 13
jq: Missing runtime type checks for _strindices lead to crash and limited memory disclosure
Affected: < 1.8.2
CVE-2026-47770
5.5
0%
Jun 25
jq: stack overflow in deep structural equality
Affected: < 1.8.2
CVE-2026-54679
5.5
0%
Jun 25
jq: potential integer overflow in jvp_string_append
Affected: < 1.8.2
CVE-2026-43896
5.5
0%
May 11
jq: Stack Overflow in Recursive Object Merge
Affected: <= 1.8.1
CVE-2026-44777
5.5
0%
May 11
jq: stack overflow in module loading on mutual `include`
Affected: <= 1.8.2rc1
CVE-2026-43894
5.5
0%
May 11
jq: Wild stack write via signed-integer overflow in decNumber D2U() macro
Affected: <= 1.8.1
CVE-2026-41256
5.5
0%
May 11
jq: Embedded NUL truncates top-level jq programs loaded with -f
Affected: <= 1.8.1
CVE-2026-40612
5.5
0%
May 11
jq: Stack overflow via unbounded recursion in jv_contains
Affected: <= 1.8.1
CVE-2026-41257
5.5
0%
May 11
jq: Signed-int overflow in `stack_reallocate` (jq VM stack)
Affected: <= 1.8.1
CVE-2026-33947
5.5
0%
Apr 13
jq: Unbounded Recursion in jv_setpath(), jv_getpath() and delpaths_sorted()
Affected: < fb59f1491058d58bdc3e8dd28f1773d1ac690a1f
CVE-2025-9403
5.5
0%
Aug 25
A vulnerability was determined in jqlang jq up to 1.6
Affected: through 1.6
CVE-2023-50268
5.5
0%
Dec 13
jq is a command-line JSON processor
Affected: 1.7
CVE-2023-50246
5.5
1%
Dec 13
jq is a command-line JSON processor
Affected: 1.7; 1.7; 1.7
CVE-2026-33948
5.3
0%
Apr 13
jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input
Affected: < 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b
CVE-2026-43895
4.4
0%
May 11
jq: Embedded NUL in jq import paths causes local redaction-policy bypass and preserves sensitive fields in published artifacts
Affected: <= 1.8.1
Showing 17