Vendor
Jqlang
24 known vulnerabilities in products by Jqlang, 0 of them actively exploited (CISA KEV).
Key figures
24
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-32316 | jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow | 7.5 | |
| High | CVE-2023-49355 | Jqlang Jq: Out-of-Bounds Write | 7.5 | |
| High | CVE-2026-39979 | jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers | 6.5 | |
| High | CVE-2025-48060 | AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) | 7.5 | |
| High | CVE-2026-49839 | jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow | 7.1 | |
| Medium | CVE-2026-54679 | jq: potential integer overflow in jvp_string_append | 5.5 | |
| Medium | CVE-2026-47770 | jq: stack overflow in deep structural equality | 5.5 | |
| High | CVE-2026-40164 | jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seed | 7.5 | |
| Medium | CVE-2026-43894 | jq: Wild stack write via signed-integer overflow in decNumber D2U() macro | 5.5 | |
| Medium | CVE-2026-43896 | jq: Stack Overflow in Recursive Object Merge | 5.5 | |
| High | CVE-2024-53427 | Jqlang Jq: Type Confusion | 8.1 | |
| Medium | CVE-2026-43895 | jqlang jq: Improper Neutralization of Null Byte or NUL Character | 4.4 | |
| Medium | CVE-2023-50246 | jq has heap-buffer-overflow vulnerability in the function decToString in decNumber.c | 6.2 | |
| Medium | CVE-2026-41257 | jq: Signed-int overflow in `stack_reallocate` (jq VM stack) | 5.5 | |
| Medium | CVE-2026-39956 | jq: Missing runtime type checks for _strindices lead to crash and limited memory disclosure | 6.1 | |
| Medium | CVE-2023-50268 | jq has stack-based buffer overflow in decNaNs | 6.2 | |
| Medium | CVE-2025-49014 | jq heap use after free vulnerability in f_strflocaltime | — | |
| Medium | CVE-2026-33947 | jq: Unbounded Recursion in jv_setpath(), jv_getpath() and delpaths_sorted() | 5.5 | |
| Medium | CVE-2026-33948 | jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input | 5.3 | |
| Medium | CVE-2026-44777 | jq: stack overflow in module loading on mutual `include` | 5.5 | |
| Medium | CVE-2026-40612 | jq: Stack overflow via unbounded recursion in jv_contains | 5.5 | |
| Medium | CVE-2026-41256 | jq: Embedded NUL truncates top-level jq programs loaded with -f | 5.5 | |
| Medium | CVE-2024-23337 | jq has signed integer overflow in jv.c:jvp_array_write | 4.3 | |
| Medium | CVE-2025-9403 | jqlang jq JSON jq_test.c run_jq_tests assertion | 3.3 |
Products
| jqlang jq | 24 | 0 |