Jqlang maintains the jq JSON query language and processor, a command-line tool widely embedded in data-processing pipelines and infrastructure automation. The vendor's vulnerability profile centers on memory-safety and input-handling weaknesses—out-of-bounds writes, integer overflows, uncontrolled recursion, type confusion, and classic buffer overflows—that are characteristic of a C-based parser and evaluator operating on untrusted JSON and filter expressions. Current severity, exploitation, and exposure figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Jqlang over time
Signals from CVEs in this vendor scope (22 CVEs).
22 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-49839HIGH jq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assert | Jun 25, 2026 | 7.1 | 32 | NO | NO |
CVE-2026-32316HIGH jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where | Apr 13, 2026 | 7.5 | 29 | NO | NO |
CVE-2026-39979MEDIUM jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length | Apr 13, 2026 | 6.5 | 28 | NO | NO |
CVE-2026-47770MEDIUM jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface | Jun 25, 2026 | 5.5 | 27 | NO | NO |
CVE-2026-54679MEDIUM jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvp_string_append has a chance of integer/multiple overflowing and then causing a massive buffer overrun. Thi | Jun 25, 2026 | 5.5 | 27 | NO | NO |
CVE-2026-44777MEDIUM jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two
otherwise valid modules include each other. | May 11, 2026 | 5.5 | 24 | NO | NO |
CVE-2026-43896MEDIUM jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The | May 11, 2026 | 5.5 | 24 | NO | NO |
CVE-2026-43894MEDIUM jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during sig | May 11, 2026 | 5.5 | 24 | NO | NO |
CVE-2026-41257MEDIUM jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deepl | May 11, 2026 | 5.5 | 24 | NO | NO |
CVE-2026-41256MEDIUM jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A | May 11, 2026 | 5.5 | 24 | NO | NO |
Signals from CVEs in this vendor scope (22 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Jqlang.
Media articles that mention a CVE ID that affects a product developed by Jqlang — matched by CVE ID, not by vendor name.