jqlang jq
23 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-47770 | < 1.8.2 | jq: stack overflow in deep structural equality | MEDIUM 6.8 | 0.1 % | ||
| CVE-2026-49839 | < 1.8.2 | jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow | HIGH 7.1 | 0.2 % | ||
| CVE-2026-54679 | < 1.8.2 | jq: potential integer overflow in jvp_string_append | MEDIUM 6.9 | 0.1 % | ||
| CVE-2026-43896 | <= 1.8.1 | jq: Stack Overflow in Recursive Object Merge | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-43895 | <= 1.8.1 | jq: Embedded NUL in jq import paths causes local redaction-policy bypass and preserves sensitive fields in published artifacts | MEDIUM 4.4 | 0.2 % | ||
| CVE-2026-44777 | <= 1.8.2rc1 | jq: stack overflow in module loading on mutual `include` | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-43894 | <= 1.8.1 | jq: Wild stack write via signed-integer overflow in decNumber D2U() macro | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-41256 | <= 1.8.1 | jq: Embedded NUL truncates top-level jq programs loaded with -f | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-40612 | <= 1.8.1 | jq: Stack overflow via unbounded recursion in jv_contains | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-41257 | <= 1.8.1 | jq: Signed-int overflow in `stack_reallocate` (jq VM stack) | MEDIUM 6.4 | 0.1 % | ||
| CVE-2026-33948 | < 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b | jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input | LOW 2.9 | 0.3 % | ||
| CVE-2026-40164 | < 0c7d133c3c7e37c00b6d46b658a02244fdd3c784 | jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seed | HIGH 7.5 | 0.4 % | ||
| CVE-2026-39979 | < 2f09060afab23fe9390cce7cb860b10416e1bf5f | jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers | MEDIUM 6.9 | 0.6 % | ||
| CVE-2026-39956 | < 1.8.2 | jq: Missing runtime type checks for _strindices lead to crash and limited memory disclosure | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-33947 | < fb59f1491058d58bdc3e8dd28f1773d1ac690a1f | jq: Unbounded Recursion in jv_setpath(), jv_getpath() and delpaths_sorted() | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-32316 | < e47e56d226519635768e6aab2f38f0ab037c09e5 | jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow | HIGH 8.2 | 0.8 % | ||
| CVE-2025-9403 | 1.0 ; 1.1 ; 1.2 ; … | jqlang jq JSON jq_test.c run_jq_tests assertion | MEDIUM 4.8 | 0.2 % | ||
| CVE-2025-49014 | = 1.8.0 | jq heap use after free vulnerability in f_strflocaltime | MEDIUM 5.5 | 0.4 % | ||
| CVE-2025-48060 | <= 1.7.1 | AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) | HIGH 7.7 | 0.6 % | ||
| CVE-2024-23337 | <= 1.7.1 | jq has signed integer overflow in jv.c:jvp_array_write | MEDIUM 6.5 | 0.5 % | ||
| CVE-2024-53427 | ≤ 1.7.1 | decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack- | HIGH 8.1 | 0.4 % | ||
| CVE-2023-50268 | = 1.7 | jq has stack-based buffer overflow in decNaNs | MEDIUM 6.2 | 0.4 % | ||
| CVE-2023-50246 | = 1.7 | jq has heap-buffer-overflow vulnerability in the function decToString in decNumber.c | MEDIUM 6.2 | 0.5 % |