jqlang jq strlen null termination

Summaryinfo

A vulnerability described as critical has been identified in jqlang jq. This vulnerability affects the function strlen. Executing a manipulation can lead to null termination. This vulnerability is registered as CVE-2026-33948. It is possible to launch the attack remotely. No exploit is available. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability has been found in jqlang jq (unknown version) and classified as critical. This vulnerability affects the function strlen. The manipulation with an unknown input leads to a null termination vulnerability. The CWE definition for the vulnerability is CWE-170. The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator. As an impact it is known to affect integrity, and availability. CVE summarizes:

jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.

The advisory is available at github.com. This vulnerability was named CVE-2026-33948 since 03/24/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit.

Applying the patch 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b is able to eliminate this problem. The bugfix is ready for download at github.com.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• jqlang

Name

• jq

License

• open-source

Website

• Product: https://github.com/jqlang/jq/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion