jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers (jqlang jq)

CVE-2026-39979

MEDIUM 6.9

At a glance

Source: NVD
EPSS: EPSS 0.56 % · percentile 47 (2026-10-31)
State: PUBLISHED
Published: 2026-04-13 22:18 UTC
Updated: 2026-07-15 01:01 UTC
Assigner: GitHub_M
NVD status: Analyzed

Search on…

Description

jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.

Weaknesses (CWE)

CWE-125 — Out-of-bounds Read

References

Scores

Version	Score	Vector	Scored by
CVSS 4.0	MEDIUM 6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N	GitHub_M
CVSS 3.1	HIGH 8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H	redhat-SADP
CVSS 4.0	MEDIUM 6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · security-advisories@github.com (Secondary)
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L	NVD · nvd@nist.gov (Primary)
CVSS 3.1	HIGH 8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H	NVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary)

European references

ENISA EUVD · EUVD-2026-22128
GCVE · GCVE-0-2026-39979

CERT-FR advisories

CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2026-AVI-0986 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-0863 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
CERTFR-2026-AVI-0832 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
CERTFR-2026-AVI-0808 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
CERTFR-2026-AVI-0781 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
CERTFR-2026-AVI-0463 — Multiples vulnérabilités dans les produits Microsoft · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:* < 1.8.2
cpe:2.3:a:redhat:ai_inference_server:*:*:*:*:*:*:*:* ≥ 3.2.0 < 3.2.2
cpe:2.3:a:redhat:ai_inference_server:*:*:*:*:*:*:*:* ≥ 3.3.0 < 3.3.5
cpe:2.3:a:redhat:ansible_automation_platform:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ceph_storage:4.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder:9.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder:10.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_eus:9.4:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_eus:9.6:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_eus:10.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_ai:*:*:*:*:*:*:*:* ≥ 3.4 < 3.4.3
cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.12 < 4.12.92
cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.13 < 4.13.68
cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.14 < 4.14.68
cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.15 < 4.15.65
cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.16 < 4.16.64
cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.17 < 4.17.55
cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.18 < 4.18.44
cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:* ≥ 4.19 < 4.19.33
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_aus:8.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_aus:8.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_tus:8.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_tus:8.8:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:*

Affected products

Product	Versions
jqlang · jq	affected < 2f09060afab23fe9390cce7cb860b10416e1bf5f

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

🟡 jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers (jqlang jq)