Denial of Service Vulnerability in jq Command-Line JSON Processor by JQlang

CVE-2026-43894

What is CVE-2026-43894?

The jq command-line JSON processor, particularly in versions 1.8.1 and earlier, is vulnerable to a Denial of Service attack. When the decNumberFromString function receives a number literal near the maximum integer size, it can lead to an overflow during signed integer arithmetic. This condition allows attackers to bypass crucial heap-allocation checks and write excessive data to a stack buffer, potentially destabilizing the application and resulting in system crashes. This vulnerability has implications for environments where jq is used for processing JSON data and should be addressed promptly to maintain system integrity.

References