CVE-2026-32316

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32316", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-11T21:16:21.660Z", "datePublished": "2026-04-13T17:49:34.095Z", "dateUpdated": "2026-10-16T22:06:40.448Z"}, "containers": {"cna": {"title": "jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow", "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "lang": "en", "description": "CWE-122: Heap-based Buffer Overflow", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-190", "lang": "en", "description": "CWE-190: Integer Overflow or Wraparound", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/jqlang/jq/security/advisories/GHSA-q3h9-m34w-h76f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/jqlang/jq/security/advisories/GHSA-q3h9-m34w-h76f"}, {"name": "https://github.com/jqlang/jq/commit/e47e56d226519635768e6aab2f38f0ab037c09e5", "tags": ["x_refsource_MISC"], "url": "https://github.com/jqlang/jq/commit/e47e56d226519635768e6aab2f38f0ab037c09e5"}], "affected": [{"vendor": "jqlang", "product": "jq", "versions": [{"version": "< e47e56d226519635768e6aab2f38f0ab037c09e5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-13T17:49:34.095Z"}, "descriptions": [{"lang": "en", "value": "jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5."}], "source": {"advisory": "GHSA-q3h9-m34w-h76f", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-13T18:56:45.829031Z", "id": "CVE-2026-32316", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T18:56:54.199Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2026/10/msg00034.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-16T22:06:40.448Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32316", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T18:56:45.829031Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T18:56:50.422Z"}}], "cna": {"title": "jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow", "source": {"advisory": "GHSA-q3h9-m34w-h76f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "jqlang", "product": "jq", "versions": [{"status": "affected", "version": "< e47e56d226519635768e6aab2f38f0ab037c09e5"}]}], "references": [{"url": "https://github.com/jqlang/jq/security/advisories/GHSA-q3h9-m34w-h76f", "name": "https://github.com/jqlang/jq/security/advisories/GHSA-q3h9-m34w-h76f", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/jqlang/jq/commit/e47e56d226519635768e6aab2f38f0ab037c09e5", "name": "https://github.com/jqlang/jq/commit/e47e56d226519635768e6aab2f38f0ab037c09e5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190: Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-13T17:49:34.095Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32316", "state": "PUBLISHED", "dateUpdated": "2026-04-13T18:56:54.199Z", "dateReserved": "2026-03-11T21:16:21.660Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-13T17:49:34.095Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "jq", "vendor": "jqlang", "versions": [{"status": "affected", "version": "< e47e56d226519635768e6aab2f38f0ab037c09e5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*", "matchCriteriaId": "2026D0D9-8A88-43D4-9995-CF7928D9FFB8", "versionEndIncluding": "1.8.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5."}, {"lang": "es", "value": "jq es un procesador JSON de l\u00ednea de comandos. Existe una vulnerabilidad de desbordamiento de entero hasta la versi\u00f3n 1.8.1 dentro de las funciones jvp_string_append() y jvp_string_copy_replace_bad, donde la concatenaci\u00f3n de cadenas con una longitud combinada que excede los 2^31 bytes causa un desbordamiento de entero sin signo de 32 bits en el c\u00e1lculo del tama\u00f1o de asignaci\u00f3n del b\u00fafer, lo que resulta en un b\u00fafer de mont\u00edculo dr\u00e1sticamente subdimensionado. Las operaciones de copia de memoria subsiguientes escriben entonces los datos completos de la cadena en este b\u00fafer subdimensionado, causando un desbordamiento de b\u00fafer basado en mont\u00edculo clasificado como CWE-190 (Desbordamiento de entero) que conduce a CWE-122 (Desbordamiento de b\u00fafer basado en mont\u00edculo). Cualquier sistema que eval\u00fae consultas jq no confiables se ve afectado, ya que un atacante puede bloquear el proceso o potencialmente lograr una explotaci\u00f3n adicional a trav\u00e9s de la corrupci\u00f3n del mont\u00edculo al elaborar consultas que producen cadenas extremadamente grandes. La causa ra\u00edz es la ausencia de verificaci\u00f3n de l\u00edmites de tama\u00f1o de cadena, a diferencia de los arreglos y objetos que ya tienen l\u00edmites de tama\u00f1o. El problema ha sido abordado en el commit e47e56d226519635768e6aab2f38f0ab037c09e5."}], "id": "CVE-2026-32316", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32316", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-13T18:56:45.829031Z", "version": "2.0.3"}}]}, "published": "2026-04-13T18:16:29.420", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/jqlang/jq/commit/e47e56d226519635768e6aab2f38f0ab037c09e5"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/jqlang/jq/security/advisories/GHSA-q3h9-m34w-h76f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2026/10/msg00034.html"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}, {"lang": "en", "value": "CWE-190"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "jq: jq: Denial of Service or potential arbitrary code execution due to integer overflow and heap-based buffer overflow", "id": "2457929", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457929"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["A flaw was found in jq, a command-line JSON processor. An attacker can exploit an integer overflow vulnerability by crafting queries that produce extremely large strings. This causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, leading to a drastically undersized memory buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap-based buffer overflow. This can result in a Denial of Service (DoS) by crashing the process or potentially allow for further exploitation through heap corruption."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, avoid processing untrusted or unvalidated JSON input with the `jq` utility. Ensure that any scripts or automated processes utilizing `jq` only operate on trusted data sources. Restricting the execution of `jq` to trusted users and environments can also reduce exposure."}, "name": "CVE-2026-32316", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "automation-controller", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "redhat-user-workloads/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "redhat-user-workloads/hub-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ceph_storage:4", "fix_state": "Fix deferred", "package_name": "jq", "product_name": "Red Hat Ceph Storage 4"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "jq", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "jq", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "jq", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-04-13T17:49:34Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-32316\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-32316\nhttps://github.com/jqlang/jq/commit/e47e56d226519635768e6aab2f38f0ab037c09e5\nhttps://github.com/jqlang/jq/security/advisories/GHSA-q3h9-m34w-h76f"], "statement": "This Moderate impact vulnerability in `jq`, a command-line JSON processor, allows for a Denial of Service or potential arbitrary code execution. The flaw occurs when `jq` processes untrusted queries that generate excessively large strings, leading to an integer overflow and heap-based buffer overflow. Red Hat products that utilize `jq` for processing JSON data are affected if they handle untrusted `jq` queries.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0,e47e56d226519635768e6aab2f38f0ab037c09e5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "jq", "source": "cna", "vendor": "jqlang"}, "product": "jq", "vendor": "jqlang"}], "analysis": {"en": {"generated_at": "2026-04-13T19:22:37.452929+00:00", "value": {"mitigation_remediation": ["Update jq to a version newer than 1.8.1 or apply the patch from commit e47e56d226519635768e6aab2f38f0ab037c09e5", "If an upgrade is not immediately feasible, limit jq usage to trusted input, run it in a restricted environment, and monitor for abnormal crashes"], "summary": {"action": "Patch", "impact": "Heap-based Buffer Overflow"}, "threat_synthesis": {"affected_systems": "jq, the command\u2011line JSON processor from the JQ language community, is affected in all releases through version\u202f1.8.1. Any system that evaluates untrusted jq queries is at risk, as the vulnerable code paths are exercised by user\u2011supplied query input.", "description_and_impact": "The flaw stems from an integer overflow in the jvp_string_append() and jvp_string_copy_replace_bad functions of jq when concatenating strings whose total length exceeds 2^31 bytes. The overflow causes the buffer allocation size calculation to under\u2011allocate the heap buffer, after which a subsequent memory copy writes the full string into this undersized buffer. The result is a heap buffer overflow classified as CWE\u2011190 and CWE\u2011122. An attacker can craft jq queries that trigger the overflow, potentially crashing the process or creating conditions for further exploitation through heap corruption.", "risk_and_exploitability": "With a CVSS score of 8.2 the vulnerability is considered high severity. The EPSS score is not available, so the current exploitation probability is unknown, but the lack of mitigation instructions and the potential to crash or corrupt memory make it a serious threat. The vulnerability is not listed in CISA\u2019s KEV catalog, indicating no widespread exploitation yet. The likely attack vector is the supply of malicious jq queries via user input, scripts, or configuration files, which directly trigger the overflow."}}}}, "created": "2026-04-14T16:18:37.398106+00:00", "updated": "2026-04-14T16:33:45.019781+00:00", "vendors": ["jqlang", "jqlang$PRODUCT$jq"]}