Loading vulnerability…
Out-of-bounds read in jq libjq jv_parse_sized() error formatting
CVE-2026-39979 is an out-of-bounds read vulnerability in the jv_parse_sized() API of jq's libjq library. Although the API accepts a buffer with an explicit length, its error-handling path passes the input to jv_string_fmt() using an unbounded %s conversion. When malformed JSON is supplied in a non-NUL-terminated buffer, error construction reads beyond the supplied buffer until a NUL byte is encountered or an invalid memory access occurs. Depending on memory layout and how the consuming application exposes errors, exploitation can disclose adjacent process memory or terminate the process.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Malformed input can cause disclosure of adjacent process memory through constructed error messages, if those messages are accessible to an attacker. Reading inaccessible memory can also terminate the consuming process, causing denial of service. The outcome depends on memory layout and application error handling; arbitrary code execution or integrity compromise is not established.
If you can’t patch tonight, do this now.
No vendor-provided workaround is specified. As a temporary application-level safeguard, ensure buffers passed to jv_parse_sized() have an accessible NUL terminator immediately after the supplied input length, for example by copying the input into a buffer allocated with one additional byte. Restricting access to parser entry points and preventing parser errors from reaching untrusted users can reduce exposure but does not correct the underlying defect.
Patch, then assume compromise.
Update jq/libjq to a build incorporating upstream commit 2f09060afab23fe9390cce7cb860b10416e1bf5f or an equivalent vendor backport. For the applicable Red Hat Enterprise Linux 8.8 support streams, install jq release 1.6-6.el8_8.4 or a subsequent fixed package; for the applicable Red Hat Enterprise Linux 8.4 support streams, install 1.5-12.el8_4.5 or a subsequent fixed package. Update bundled or statically linked libjq copies in consuming applications as well.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
61 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.