CVE-2026-39979

Name of the Vulnerable Software and Affected Versions jq versions prior to 2f09060afab23fe9390cce7cb860b10416e1bf5f

Description The jv parse sized() API in libjq accepts a counted buffer with an explicit length parameter. However, its error-handling path formats the input buffer using %s in jv string fmt(), which reads until a NUL terminator is found instead of respecting the provided length. When malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. This can lead to memory disclosure or process termination depending on the memory layout.

Recommendations Update to version 2f09060afab23fe9390cce7cb860b10416e1bf5f.