Product by Debian
Jq
18 known vulnerabilities in Jq (Debian), 0 of them actively exploited (CISA KEV).
Key figures
18
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-32316 | jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow | 7.5 | |
| High | CVE-2026-39979 | jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers | 6.5 | |
| High | CVE-2025-48060 | AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) | 7.5 | |
| High | CVE-2026-49839 | jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow | 7.1 | |
| Medium | CVE-2026-54679 | jq: potential integer overflow in jvp_string_append | 5.5 | |
| Medium | CVE-2026-47770 | jq: stack overflow in deep structural equality | 5.5 | |
| High | CVE-2026-40164 | jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seed | 7.5 | |
| Medium | CVE-2026-43894 | jq: Wild stack write via signed-integer overflow in decNumber D2U() macro | 5.5 | |
| Medium | CVE-2026-43896 | jq: Stack Overflow in Recursive Object Merge | 5.5 | |
| High | CVE-2024-53427 | Jqlang Jq: Type Confusion | 8.1 | |
| Medium | CVE-2026-43895 | jqlang jq: Improper Neutralization of Null Byte or NUL Character | 4.4 | |
| Medium | CVE-2026-41257 | jq: Signed-int overflow in `stack_reallocate` (jq VM stack) | 5.5 | |
| Medium | CVE-2026-39956 | jq: Missing runtime type checks for _strindices lead to crash and limited memory disclosure | 6.1 | |
| Medium | CVE-2026-33947 | jq: Unbounded Recursion in jv_setpath(), jv_getpath() and delpaths_sorted() | 5.5 | |
| Medium | CVE-2026-33948 | jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input | 5.3 | |
| Medium | CVE-2026-44777 | jq: stack overflow in module loading on mutual `include` | 5.5 | |
| Medium | CVE-2026-40612 | jq: Stack overflow via unbounded recursion in jv_contains | 5.5 | |
| Medium | CVE-2026-41256 | jq: Embedded NUL truncates top-level jq programs loaded with -f | 5.5 |