CVE-2026-49839
published 2026-06-25CVE-2026-49839: jq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-string error into invalid-state reuse and a real heap…
PriorityP430high7.1CVSS 3.1
AVLACLPRNUIRSUCNIHAH
EPSS
0.17%
6.1th percentile
jq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds. When jv_load_file(raw=1) reads an attacker-controlled file, it repeatedly appends file chunks to the same jv string accumulator. Once jv_string_append_buf() returns jv_invalid_with_msg("String too long"), the raw-file loop does not stop. If the file contains at least one more byte, the next loop iteration appends a new chunk to an object that is already invalid. With assertions enabled this aborts in jvp_string_ptr(). With assertions disabled, the invalid object is interpreted as a string object and ASan reports heap-buffer-overflow. This vulnerability is fixed in 1.8.2.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | controller-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| jqlang | jq | < 1.8.2 | 1.8.2 |
| jqlang | jq | — | — |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
jq: jq: Heap out-of-bounds write via oversized raw file processing
vendor_redhat·2026-06-25·CVSS 7.1
CVE-2026-49839 [HIGH] CWE-787 jq: jq: Heap out-of-bounds write via oversized raw file processing
jq: jq: Heap out-of-bounds write via oversized raw file processing
jq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds. When jv_load_file(raw=1) reads an attacker-controlled file, it repeatedly appends file chunks to the same jv string accumulator. Once jv_string_append_buf() returns jv_invalid_with_msg("String too long"), the raw-file loop does not stop. If the file contains at least one more byte, the next loop iteration appends a new chunk to an object that is already invalid. With assertions enabled this aborts in jvp_string_ptr(). With assertions disabled, the invalid object is interpreted as a string object and ASan reports heap-buffer-o
VulDB
jqlang jq up to 1.8.1 jv_string_append_buf out-of-bounds write
vuldb·2026-06-25·CVSS 7.1
CVE-2026-49839 [HIGH] jqlang jq up to 1.8.1 jv_string_append_buf out-of-bounds write
A vulnerability identified as critical has been detected in jqlang jq up to 1.8.1. Affected is the function jv_string_append_buf. Performing a manipulation results in out-of-bounds write.
This vulnerability is reported as CVE-2026-49839. The attack requires a local approach. No exploit exists.
You should upgrade the affected component.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-49839 jq: jq: Heap out-of-bounds write via oversized raw file processing [fedora-all]
bugzilla·2026-06-29·CVSS 7.1
CVE-2026-49839 [HIGH] CVE-2026-49839 jq: jq: Heap out-of-bounds write via oversized raw file processing [fedora-all]
CVE-2026-49839 jq: jq: Heap out-of-bounds write via oversized raw file processing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds. When jv_load_file(raw=1) reads an attacker-controlled file, it repeatedly appends file chunks to the same jv string accumulator. Once jv_string_append_buf() returns jv_invalid_with_msg("String too long"), the raw-file loop does not stop. If the file contains at least one more b
Bugzilla
CVE-2026-49839 jq: jq: Heap out-of-bounds write via oversized raw file processing
bugzilla·2026-06-25·CVSS 7.1
CVE-2026-49839 [HIGH] CVE-2026-49839 jq: jq: Heap out-of-bounds write via oversized raw file processing
CVE-2026-49839 jq: jq: Heap out-of-bounds write via oversized raw file processing
jq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds. When jv_load_file(raw=1) reads an attacker-controlled file, it repeatedly appends file chunks to the same jv string accumulator. Once jv_string_append_buf() returns jv_invalid_with_msg("String too long"), the raw-file loop does not stop. If the file contains at least one more byte, the next loop iteration appends a new chunk to an object that is already invalid. With assertions enabled this aborts in jvp_string_ptr(). With assertions disabled, the invalid object is interpreted as a string object and ASan report
2026-06-25
Published