CVE-2026-41256 in jqlang
Summary
by MITRE • 05/11/2026
jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/05/2026
The vulnerability in jq version 1.8.1 and earlier represents a critical buffer handling flaw that affects how the command-line JSON processor processes top-level filter programs loaded from files using the -f flag. This issue stems from an inadequate implementation of input processing that fails to properly handle null byte characters within filter files, creating a dangerous discrepancy between the expected and actual processing behavior. The vulnerability manifests when a maliciously crafted filter file contains a NUL byte, causing the program to truncate execution at the first embedded null character rather than processing the complete file content.
The technical flaw operates on a fundamental mismatch between buffer handling and input parsing mechanisms within jq's compilation pipeline. When a filter file is loaded with -f, the system processes the input stream until it encounters a NUL byte, at which point it abruptly terminates the processing regardless of whether additional valid content exists beyond that point. This truncation behavior creates an inconsistency where the compiled program operates on only a prefix of the intended filter, while the underlying buffer management system continues to expect processing of the full file contents. The vulnerability specifically affects the compilation path rather than the JSON parsing path, which had previously been addressed in CVE-2026-33948, leaving this particular attack surface exposed.
The operational impact of this vulnerability extends beyond simple truncation to encompass potential code execution manipulation and privilege escalation scenarios. An attacker who can control or influence filter files loaded with -f could craft malicious inputs that bypass intended security controls by exploiting the NUL byte truncation mechanism. This creates opportunities for bypassing access controls, executing unintended operations, or manipulating program flow in ways that were not anticipated in the original design. The vulnerability particularly affects systems where jq is used in automated processing pipelines or security-sensitive contexts where filter files may be provided by untrusted sources.
Security mitigations for this vulnerability should focus on implementing robust input validation and buffer boundary checking throughout the compilation process. The fix must ensure that all input processing respects complete file boundaries regardless of embedded special characters, including null bytes, while maintaining compatibility with existing legitimate use cases. Organizations should immediately upgrade to patched versions of jq where the buffer handling has been corrected to properly process entire filter files without truncation. Additionally, administrators should implement strict access controls over filter files and consider validating input content through additional layers of verification before executing jq commands with -f flags, particularly in environments where untrusted inputs may be processed.
This vulnerability aligns with CWE-129 Input Validation and CWE-787 Out-of-bounds Write categories, representing a classic buffer boundary issue that enables unauthorized code execution through input manipulation. From an ATT&CK perspective, this maps to T1059 Command and Scripting Interpreter and potentially T1566 Impair Defenses where the vulnerability could be leveraged to bypass security controls in automated processing systems. The attack surface is particularly concerning in environments where jq is used for processing untrusted JSON data or where filter files are dynamically generated from user inputs without proper sanitization.