Jq is a widely used command-line JSON processor and programming language, deployed across development pipelines, DevOps workflows, and data-processing infrastructure despite its narrow, single-product footprint. The recurring vulnerability pattern centers on resource-management issues—specifically uncontrolled resource allocation and memory-buffer boundary violations—reflecting the parsing and filtering demands of a JSON query engine. Current severity, exploitation status, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Jq Project over time
Signals from CVEs in this vendor scope (2 CVEs).
2 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2016-4074HIGH The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted JSON file. This issue has been fixe | May 6, 2016 | 7.5 | 27 | NO | NO |
CVE-2015-8863CRITICAL Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-bas | May 6, 2016 | 9.8 | 27 | NO | NO |
Signals from CVEs in this vendor scope (2 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Jq Project.
Media articles that mention a CVE ID that affects a product developed by Jq Project — matched by CVE ID, not by vendor name.