jqlang records

22 published records for vendor jqlang.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 100%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

22 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
32Monitor	CVE-2024-53427No exploit	decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-jqlang · jq · CWE-843	High8.1	—	0.3%	Feb 26, 2025
30Monitor	CVE-2023-49355No exploit	decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" input.jqlang · jq · CWE-787 Pre-auth Memory safety Denial of service	High7.5	—	1.1%	Dec 11, 2023
30Monitor	CVE-2026-32316No exploit	jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflowjqlang · jq · CWE-122 Pre-auth Memory safety Denial of service	High7.5	—	0.7%	Apr 13, 2026
30Monitor	CVE-2025-48060Proof of concept	AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt)jqlang · jq · CWE-121 Pre-auth Memory safety	High7.7	—	0.5%	May 21, 2025
28Monitor	CVE-2026-49839No exploit	jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflowjqlang · jq · CWE-787 Memory safety	High7.1	—	0.1%	Jun 25, 2026
27Monitor	CVE-2026-39979No exploit	jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffersjqlang · jq · CWE-125 Pre-auth Memory safety	Medium6.9	—	0.5%	Apr 13, 2026
27Monitor	CVE-2026-47770No exploit	jq: stack overflow in deep structural equalityjqlang · jq · CWE-674 Denial of service	Medium6.8	—	0.1%	Jun 25, 2026
27Monitor	CVE-2026-54679No exploit	jq: potential integer overflow in jvp_string_appendjqlang · jq · CWE-190 Memory safety	Medium6.9	—	0.1%	Jun 25, 2026
26Monitor	CVE-2024-23337No exploit	jq has signed integer overflow in jv.c:jvp_array_writejqlang · jq · CWE-190 Pre-auth Memory safety Denial of service	Medium6.5	—	0.4%	May 21, 2025
25Monitor	CVE-2026-41257No exploit	jq: Signed-int overflow in `stack_reallocate` (jq VM stack)jqlang · jq · CWE-190 Memory safety	Medium6.4	—	0.1%	May 11, 2026
24Monitor	CVE-2026-39956No exploit	jq: Missing runtime type checks for _strindices lead to crash and limited memory disclosurejqlang · jq · CWE-125 Memory safety	Medium6.1	—	0.1%	Apr 13, 2026
22Monitor	CVE-2023-50246No exploit	jq has heap-buffer-overflow vulnerability in the function decToString in decNumber.cjqlang · jq · CWE-120 Memory safety Denial of service	Medium5.5	—	0.5%	Dec 13, 2023
22Monitor	CVE-2023-50268No exploit	jq has stack-based buffer overflow in decNaNsjqlang · jq · CWE-120 Memory safety Denial of service	Medium5.5	—	0.4%	Dec 13, 2023
22Monitor	CVE-2026-33947No exploit	jq: Unbounded Recursion in jv_setpath(), jv_getpath() and delpaths_sorted()jqlang · jq · CWE-674 Denial of service	Medium5.5	—	0.2%	Apr 13, 2026
22Monitor	CVE-2026-43894No exploit	jq: Wild stack write via signed-integer overflow in decNumber D2U() macrojqlang · jq · CWE-190 Memory safety Denial of service	Medium5.5	—	0.1%	May 11, 2026
22Monitor	CVE-2026-41256No exploit	jq: Embedded NUL truncates top-level jq programs loaded with -fjqlang · jq · CWE-158	Medium5.5	—	0.1%	May 11, 2026
22Monitor	CVE-2026-43896No exploit	jq: Stack Overflow in Recursive Object Mergejqlang · jq · CWE-674 Denial of service	Medium5.5	—	0.1%	May 11, 2026
21Monitor	CVE-2026-40612No exploit	jq: Stack overflow via unbounded recursion in jv_containsjqlang · jq · CWE-674 Denial of service	Medium5.4	—	0.1%	May 11, 2026
21Monitor	CVE-2026-44777No exploit	jq: stack overflow in module loading on mutual `include`jqlang · jq · CWE-674 Denial of service	Medium5.4	—	0.1%	May 11, 2026
17Monitor	CVE-2026-43895No exploit	jq: Embedded NUL in jq import paths causes local redaction-policy bypass and preserves sensitive fields in published artifactsjqlang · jq · CWE-20	Medium4.4	—	0.1%	May 11, 2026
11Monitor	CVE-2026-33948No exploit	jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Inputjqlang · jq · CWE-20 Pre-auth	Low2.9	—	0.2%	Apr 14, 2026
7Monitor	CVE-2025-9403No exploit	jqlang jq JSON jq_test.c run_jq_tests assertionjqlang · jq · CWE-617	Low1.9	—	0.2%	Aug 24, 2025

CVE-2024-53427
32Monitor
decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-
HighCVSS 8.1No exploitEPSS 0%
jqlang · jqFeb 26, 2025
CVE-2023-49355
30Monitor
decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" input.
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Memory safety
- Denial of service
jqlang · jqDec 11, 2023
CVE-2026-32316
30Monitor
jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
jqlang · jqApr 13, 2026
CVE-2025-48060
30Monitor
AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt)
HighCVSS 7.7Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
jqlang · jqMay 21, 2025
CVE-2026-49839
28Monitor
jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
jqlang · jqJun 25, 2026
CVE-2026-39979
27Monitor
jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers
MediumCVSS 6.9No exploitEPSS 0%
- Pre-auth
- Memory safety
jqlang · jqApr 13, 2026
CVE-2026-47770
27Monitor
jq: stack overflow in deep structural equality
MediumCVSS 6.8No exploitEPSS 0%
- Denial of service
jqlang · jqJun 25, 2026
CVE-2026-54679
27Monitor
jq: potential integer overflow in jvp_string_append
MediumCVSS 6.9No exploitEPSS 0%
- Memory safety
jqlang · jqJun 25, 2026
CVE-2024-23337
26Monitor
jq has signed integer overflow in jv.c:jvp_array_write
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
jqlang · jqMay 21, 2025
CVE-2026-41257
25Monitor
jq: Signed-int overflow in `stack_reallocate` (jq VM stack)
MediumCVSS 6.4No exploitEPSS 0%
- Memory safety
jqlang · jqMay 11, 2026
CVE-2026-39956
24Monitor
jq: Missing runtime type checks for _strindices lead to crash and limited memory disclosure
MediumCVSS 6.1No exploitEPSS 0%
- Memory safety
jqlang · jqApr 13, 2026
CVE-2023-50246
22Monitor
jq has heap-buffer-overflow vulnerability in the function decToString in decNumber.c
MediumCVSS 5.5No exploitEPSS 0%
- Memory safety
- Denial of service
jqlang · jqDec 13, 2023
CVE-2023-50268
22Monitor
jq has stack-based buffer overflow in decNaNs
MediumCVSS 5.5No exploitEPSS 0%
- Memory safety
- Denial of service
jqlang · jqDec 13, 2023
CVE-2026-33947
22Monitor
jq: Unbounded Recursion in jv_setpath(), jv_getpath() and delpaths_sorted()
MediumCVSS 5.5No exploitEPSS 0%
- Denial of service
jqlang · jqApr 13, 2026
CVE-2026-43894
22Monitor
jq: Wild stack write via signed-integer overflow in decNumber D2U() macro
MediumCVSS 5.5No exploitEPSS 0%
- Memory safety
- Denial of service
jqlang · jqMay 11, 2026
CVE-2026-41256
22Monitor
jq: Embedded NUL truncates top-level jq programs loaded with -f
MediumCVSS 5.5No exploitEPSS 0%
jqlang · jqMay 11, 2026
CVE-2026-43896
22Monitor
jq: Stack Overflow in Recursive Object Merge
MediumCVSS 5.5No exploitEPSS 0%
- Denial of service
jqlang · jqMay 11, 2026
CVE-2026-40612
21Monitor
jq: Stack overflow via unbounded recursion in jv_contains
MediumCVSS 5.4No exploitEPSS 0%
- Denial of service
jqlang · jqMay 11, 2026
CVE-2026-44777
21Monitor
jq: stack overflow in module loading on mutual `include`
MediumCVSS 5.4No exploitEPSS 0%
- Denial of service
jqlang · jqMay 11, 2026
CVE-2026-43895
17Monitor
jq: Embedded NUL in jq import paths causes local redaction-policy bypass and preserves sensitive fields in published artifacts
MediumCVSS 4.4No exploitEPSS 0%
jqlang · jqMay 11, 2026
CVE-2026-33948
11Monitor
jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input
LowCVSS 2.9No exploitEPSS 0%
- Pre-auth
jqlang · jqApr 14, 2026
CVE-2025-9403
7Monitor
jqlang jq JSON jq_test.c run_jq_tests assertion
LowCVSS 1.9No exploitEPSS 0%
jqlang · jqAug 24, 2025