VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Apr 13, 2026· Updated Oct 26, 2026

CVE-2026-39979

CVE-2026-39979

Description

jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

33
  • Jqlang/Jqllm-fuzzy2 versions
    <2f09060afab23fe9390cce7cb860b10416e1bf5f+ 1 more
    • (no CPE)range: <2f09060afab23fe9390cce7cb860b10416e1bf5f
    • cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*range: <1.8.2
  • osv-coords4 versions
    pkg:rpm/opensuse/jq&distro=openSUSE%20Tumbleweedpkg:rpm/almalinux/jq-develpkg:rpm/almalinux/jqpkg:rpm/opensuse/jq&distro=openSUSE%20Leap%2016.0
    < 1.8.1-3.1+ 3 more
    • (no CPE)range: < 1.8.1-3.1
    • (no CPE)range: < 1.6-12.el8_10
    • (no CPE)range: < 1.6-12.el8_10
    • (no CPE)range: < 1.7.1-160000.3.1
  • Red Hat/AI Inference Server
    cpe:2.3:a:redhat:ai_inference_server:*:*:*:*:*:*:*:*
    Range: >=3.2.0,<3.2.2
  • Red Hat/Ansible Automation Platform
    cpe:2.3:a:redhat:ansible_automation_platform:2.0:*:*:*:*:*:*:*
  • Red Hat/Ceph Storage
    cpe:2.3:a:redhat:ceph_storage:4.0:*:*:*:*:*:*:*
  • Red Hat/Codeready Linux Builder For X86 643 versions
    cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:codeready_linux_builder:9.0:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:codeready_linux_builder:10.0:*:*:*:*:*:*:*
  • Red Hat/Codeready Linux Builder Eus3 versions
    cpe:2.3:a:redhat:codeready_linux_builder_eus:9.4:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:redhat:codeready_linux_builder_eus:9.4:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:codeready_linux_builder_eus:9.6:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:codeready_linux_builder_eus:10.0:*:*:*:*:*:*:*
  • Red Hat/Hardened Images
    cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*
  • Red Hat/Openshift AI
    cpe:2.3:a:redhat:openshift_ai:*:*:*:*:*:*:*:*
    Range: >=3.4,<3.4.3
  • Red Hat/Openshift Container Platform
    cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*
    Range: >=4.12,<4.12.92
  • Red Hat/Enterprise Linux Server7 versions
    cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*+ 6 more
    • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_aus:8.4:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_aus:8.6:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_tus:8.6:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_tus:8.8:*:*:*:*:*:*:*
  • Red Hat/Enterprise Linux Eus4 versions
    cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_eus:10.0:*:*:*:*:*:*:*
  • Red Hat/Enterprise Linux Update Services For Sap Solutions4 versions
    cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

32

News mentions

0

No linked articles in our index yet.