Out-of-Bounds Read Vulnerability in jq Command-Line JSON Processor by JQLang

CVE-2026-39979

What is CVE-2026-39979?

The jq command-line JSON processor contains a vulnerability in the jv_parse_sized() API within libjq. When processing a counted buffer with an explicit length parameter, the error-handling mechanism erroneously uses a format that reads until a NUL terminator instead of honoring the specified length. As a result, feeding malformed JSON through a non-NUL-terminated buffer enables out-of-bounds reads, potentially leading to memory disclosure or application crashes. This vulnerability affects all libjq consumers using the vulnerable API, necessitating immediate attention and updates to the patched version.

References