Memory Management Vulnerability in jq Command-Line JSON Processor by jqlang

CVE-2026-39956

What is CVE-2026-39956?

There is a vulnerability in jq, the command-line JSON processor, where the _strindices builtin incorrectly passes unverified arguments to the jv_string_indexes() function. This oversight means that non-string inputs can lead to a controlled pointer dereference, which could allow an attacker to manipulate memory and potentially crash the application. Such attacks become feasible when evaluating untrusted filters against jq's release builds, where the assert checks are disabled. The vulnerability has been addressed in a subsequent commit.

References