--- id: CVE-2026-39979 title: jq is a command-line JSON processor summary: >- jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input … severity: medium cvss: 6.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L' cwe: - CWE-125 vendor: jqlang product: jq affected: - jq < 2026-04-12 patched: - jq 2026-04-12 published: '2026-04-13' updated: '2026-07-02' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-39979' references: - url: >- https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f label: security-advisories@github.com - url: 'https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p' label: security-advisories@github.com - url: 'https://access.redhat.com/errata/RHSA-2026:16252' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:16692' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:16693' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:18040' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:18042' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:18043' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:18044' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:18045' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:18046' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:18047' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:18048' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:19151' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:19365' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:23233' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:23245' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:25044' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:25096' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:25181' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:26528' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:26542' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:28887' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:30078' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:30087' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:30088' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:30089' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:8579' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-39979' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2458077' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p' label: 134c704f-9b21-4f2e-91b3-4a467353bcc0 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39979.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2026-39979' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-39979' - url: 'https://access.redhat.com/errata/RHSA-2026:34098' tags: - nvd - csaf - vex - red-hat epss: 0.0056 epssPercentile: 0.46726 ingestedAt: '2026-07-02T12:34:40.504Z' scores: nvd: 6.5 vendor: 8.2 --- ## Overview jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f. ## Affected - `jq < 2026-04-12` ## Remediation Upgrade past the affected range: - `jq 2026-04-12` ## Vendor advisories - **RHSA-2026:26528** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:26528) - **RHSA-2026:26542** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:26542) - **RHSA-2026:28887** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.14 · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:28887) - **RHSA-2026:23233** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.15 · released 2026-06-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:23233) - **RHSA-2026:25044** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2026-06-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:25044) - **RHSA-2026:34098** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.17 · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:34098) - **RHSA-2026:25181** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.18 · released 2026-06-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:25181) - **RHSA-2026:23245** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.19 · released 2026-06-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:23245) - **RHSA-2026:16252** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-05-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:16252) - **RHSA-2026:18048** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-05-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:18048) - **RHSA-2026:18047** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6) · released 2026-05-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:18047) - **Red Hat VEX** · Important · affected: Red Hat Ansible Automation Platform 2, Red Hat Ceph Storage 4 · no fix planned: Red Hat Ceph Storage 4, Red Hat Ansible Automation Platform 2 · updated 2026-10-02 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39979.json)