JQ
Vendor
jqlang
24
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-47770 | JQ jq jqlang | 5.5 | Jun 25 | jq: stack overflow in deep structural equality |
| CVE-2026-49839 | JQ jq jqlang | 7.1 | Jun 25 | jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow |
| CVE-2026-54679 | JQ jq jqlang | 5.5 | Jun 25 | jq: potential integer overflow in jvp_string_append |
| CVE-2026-43896 | JQ jq jqlang | 5.5 | May 11 | jq: Stack Overflow in Recursive Object Merge |
| CVE-2026-43895 | JQ jq jqlang | 4.4 | May 11 | jq: Embedded NUL in jq import paths causes local redaction-policy bypass and preserves sensitive fields in published artifacts |
| CVE-2026-44777 | JQ jq jqlang | 5.5 | May 11 | jq: stack overflow in module loading on mutual `include` |
| CVE-2026-43894 | JQ jq jqlang | 5.5 | May 11 | jq: Wild stack write via signed-integer overflow in decNumber D2U() macro |
| CVE-2026-41256 | JQ jq jqlang | 5.5 | May 11 | jq: Embedded NUL truncates top-level jq programs loaded with -f |
| CVE-2026-40612 | JQ jq jqlang | 5.5 | May 11 | jq: Stack overflow via unbounded recursion in jv_contains |
| CVE-2026-41257 | JQ jq jqlang | 5.5 | May 11 | jq: Signed-int overflow in `stack_reallocate` (jq VM stack) |
| CVE-2026-33948 | JQ jq jqlang | 5.3 | Apr 13 | jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input |
| CVE-2026-40164 | JQ jq jqlang | 7.5 | Apr 13 | jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seed |
| CVE-2026-39979 | JQ jq jqlang | 6.5 | Apr 13 | jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers |
| CVE-2026-39956 | JQ jq jqlang | 6.1 | Apr 13 | jq: Missing runtime type checks for _strindices lead to crash and limited memory disclosure |
| CVE-2026-33947 | JQ jq jqlang | 5.5 | Apr 13 | jq: Unbounded Recursion in jv_setpath(), jv_getpath() and delpaths_sorted() |
| CVE-2026-32316 | JQ jq jqlang | 7.5 | Apr 13 | jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow |
| CVE-2025-9403 | JQ jq jqlang | 5.5 | Aug 25 | jqlang jq JSON jq_test.c run_jq_tests assertion |
| CVE-2025-49014 | JQ jq jqlang | 5.5 | Jun 19 | jq heap use after free vulnerability in f_strflocaltime |
| CVE-2025-48060 | JQ jq jqlang | 7.5 | May 21 | AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) |
| CVE-2024-23337 | JQ jq jqlang | 6.5 | May 21 | jq has signed integer overflow in jv.c:jvp_array_write |
| CVE-2024-53427 | JQ jq jqlang | 8.1 | Feb 26 | decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds… |
| CVE-2023-50268 | JQ JQ Jqlang | 5.5 | Dec 13 | jq is a command-line JSON processor |
| CVE-2023-50246 | JQ JQ Jqlang | 5.5 | Dec 13 | jq is a command-line JSON processor |
| CVE-2023-49355 | JQ JQ Jqlang | 7.5 | Dec 11 | decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" input |