jqlang jq up to 1.8.1 jv_string_append_buf out-of-bounds write

Summaryinfo

A vulnerability labeled as critical has been found in jqlang jq up to 1.8.1. Affected by this vulnerability is the function jv_string_append_buf. Executing a manipulation can lead to out-of-bounds write. This vulnerability appears as CVE-2026-49839. The attack requires local access. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical was found in jqlang jq up to 1.8.1. This vulnerability affects the function jv_string_append_buf. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

jq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds. When jv_load_file(raw=1) reads an attacker-controlled file, it repeatedly appends file chunks to the same jv string accumulator. Once jv_string_append_buf() returns jv_invalid_with_msg("String too long"), the raw-file loop does not stop. If the file contains at least one more byte, the next loop iteration appends a new chunk to an object that is already invalid. With assertions enabled this aborts in jvp_string_ptr(). With assertions disabled, the invalid object is interpreted as a string object and ASan reports heap-buffer-overflow. This vulnerability is fixed in 1.8.2.

The advisory is available at github.com. This vulnerability was named CVE-2026-49839 since 06/01/2026. The exploitation appears to be easy. Local access is required to approach this attack. Technical details are known, but there is no available exploit.

Upgrading to version 1.8.2 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• jqlang

Name

• jq

Version

• 1.8.0
• 1.8.1

Website

• Product: https://github.com/jqlang/jq/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion