jq
- Software type
- Developer tool
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, jq recorded 0 security vulnerabilities in the last 90 days, of which 0 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of jq and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-54679jq: potential integer overflow in jvp_string_appendCVE-2026-49839jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflowCVE-2026-47770jq: stack overflow in deep structural equalityCVE-2026-44777jq: stack overflow in module loading on mutual `include`CVE-2026-43896jq: Stack Overflow in Recursive Object Merge| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-54679jq: potential integer overflow in jvp_string_append | Exploitation statusNot exploited | FixYes |
| SeverityMedium |
CVE-2026-49839jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow | Exploitation statusActively exploited | FixYes | Published06/25/2026 | SeverityHigh |
|---|
CVE-2026-47770jq: stack overflow in deep structural equality | Exploitation statusNot exploited | FixYes | Published06/25/2026 | SeverityMedium |
|---|
CVE-2026-44777jq: stack overflow in module loading on mutual `include` | Exploitation statusActively exploited | FixNo | Published05/11/2026 | SeverityMedium |
|---|
CVE-2026-43896jq: Stack Overflow in Recursive Object Merge | Exploitation statusActively exploited | FixNo | Published05/11/2026 | SeverityMedium |
|---|
CVE-2026-43895jq: Embedded NUL in jq import paths causes local redaction-policy bypass and preserves sensitive fields in published artifacts | Exploitation statusActively exploited | FixNo | Published05/11/2026 | SeverityMedium |
|---|
CVE-2026-43894jq: Wild stack write via signed-integer overflow in decNumber D2U() macro | Exploitation statusActively exploited | FixNo | Published05/11/2026 | SeverityMedium |
|---|
CVE-2026-41257jq: Signed-int overflow in `stack_reallocate` (jq VM stack) | Exploitation statusNot exploited | FixNo | Published05/11/2026 | SeverityMedium |
|---|
CVE-2026-41256jq: Embedded NUL truncates top-level jq programs loaded with -f | Exploitation statusActively exploited | FixNo | Published05/11/2026 | SeverityMedium |
|---|
CVE-2026-40612jq: Stack overflow via unbounded recursion in jv_contains | Exploitation statusActively exploited | FixNo | Published05/11/2026 | SeverityMedium |
|---|
CVE-2026-40164jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seed | Exploitation statusActively exploited | FixYes | Published04/13/2026 | SeverityHigh |
|---|
CVE-2026-39979jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers | Exploitation statusActively exploited | FixYes | Published04/13/2026 | SeverityMedium |
|---|
CVE-2026-39956jq: Missing runtime type checks for _strindices lead to crash and limited memory disclosure | Exploitation statusActively exploited | FixYes | Published04/13/2026 | SeverityMedium |
|---|
CVE-2026-33948jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input | Exploitation statusActively exploited | FixYes | Published04/13/2026 | SeverityLow |
|---|
CVE-2026-33947jq: Unbounded Recursion in jv_setpath(), jv_getpath() and delpaths_sorted() | Exploitation statusActively exploited | FixNo | Published04/13/2026 | SeverityMedium |
|---|
CVE-2026-32316jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow | Exploitation statusActively exploited | FixNo | Published04/13/2026 | SeverityHigh |
|---|
CVE-2025-9403jqlang jq JSON jq_test.c run_jq_tests assertion | Exploitation statusActively exploited | FixNo | Published08/25/2025 | SeverityMedium |
|---|
CVE-2025-49014jq heap use after free vulnerability in f_strflocaltime | Exploitation statusActively exploited | FixYes | Published06/19/2025 | SeverityMedium |
|---|
CVE-2025-48060AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) | Exploitation statusActively exploited | FixNo | Published05/21/2025 | SeverityHigh |
|---|
CVE-2024-23337jq has signed integer overflow in jv.c:jvp_array_write | Exploitation statusActively exploited | FixNo | Published05/21/2025 | SeverityMedium |
|---|
CVE-2024-53427CVE-2024-53427 | Exploitation statusActively exploited | FixNo | Published02/26/2025 | SeverityHigh |
|---|
CVE-2023-50268jq has stack-based buffer overflow in decNaNs | Exploitation statusNot confirmed | FixNo | Published12/13/2023 | SeverityMedium |
|---|
CVE-2023-50246jq has heap-buffer-overflow vulnerability in the function decToString in decNumber.c | Exploitation statusNot exploited | FixNo | Published12/13/2023 | SeverityMedium |
|---|
23 Results | Page 1 of 1