Introduction
An integer overflow in jq's internal string handling functions lets an attacker trigger a heap buffer overflow with a query that concatenates strings beyond 2^31 bytes. The result is a crash, and potentially heap corruption that could support further exploitation. This CVSS 8.2 vulnerability is a real risk for any infrastructure that evaluates untrusted jq queries (CI/CD pipelines, API gateways, data transformation services), and it needs prompt attention.
jq is an open-source, purely functional domain-specific language for slicing, filtering, and transforming JSON data from the command line. It is written in portable C and runs across Linux, macOS, and Windows, and it is embedded in a great many automation scripts, container images, and cloud tools. Because so many data processing pipelines are built on it, a vulnerability in jq matters well beyond its modest footprint as a single binary.
Technical information
The vulnerability is in two internal functions, jvp_string_append() and jvp_string_copy_replace_bad(), which handle string concatenation and replacement in jq's value processing layer. Both compute the buffer allocation size for the resulting string with a 32-bit unsigned integer. When the combined length of the strings exceeds 2^31 bytes, that calculation overflows and wraps around to a small value.
The allocator then provisions a heap buffer from this drastically undersized value. The memory copies that follow ignore the truncated size and use the full length of the string data, so the whole payload is written into a buffer far too small to hold it. That is a classic heap buffer overflow.
The chain is classified as CWE-190 (Integer Overflow or Wraparound) leading to CWE-122 (Heap-based Buffer Overflow).
The advisory points out that jq already enforces size limits on arrays and objects. When CVE-2024-23337 was fixed in version 1.8.0, the maintainers capped those data structures at 2^29 elements. Strings never got an equivalent bound, and CVE-2026-32316 is the direct consequence of that gap.
Attack flow
-
The attacker finds a service, script, or endpoint that accepts and evaluates jq expressions from untrusted sources. This could be an API that uses jq for JSON transformation, a webhook processor, or a shared CI/CD pipeline.
-
The attacker writes a jq query that produces a string longer than 2^31 bytes. Repeated string concatenation or multiplication in the jq expression language is enough to do this.
-
When the target system evaluates the query,
jvp_string_append()orjvp_string_copy_replace_bad()computes the required buffer size. The 32-bit unsigned integer overflows, and the allocation comes out small. -
The subsequent
memcpy(or equivalent) writes the full string data into the undersized heap buffer, corrupting adjacent heap metadata and data. -
The immediate result is typically a process crash (denial of service). Depending on the heap allocator, memory layout, and operating system, an attacker may be able to use the heap corruption for further exploitation.
The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) rates exploitation as network accessible and low complexity, with no privileges and no user interaction required. The primary impact is high availability loss, with low integrity impact.
Affected systems and versions
All versions of jq up to and including version 1.8.1 are affected. The fix is in commit e47e56d226519635768e6aab2f38f0ab037c09e5, which had not yet been included in a tagged release at the time of disclosure.
Any system that evaluates untrusted jq queries is vulnerable. That includes, among others:
- Services or APIs that accept jq filter expressions from external users
- CI/CD pipelines where jq processes data from untrusted sources
- Container images and automation scripts using jq versions 1.8.1 or earlier
Vendor security history
The jq project has fixed several memory-safety vulnerabilities in recent releases, which shows how hard it is to parse complex data safely in a C codebase.
| Vulnerability | Version addressed | Description |
|---|---|---|
| CVE-2023-50246 | 1.7.1 | Heap buffer overflow in number literal parsing |
| CVE-2024-23337 | 1.8.0 | Signed integer overflow in array and object functions. Introduced 2^29-element size limits |
| CVE-2025-48060 | 1.8.0 | Heap buffer overflow in string formatting |
| CVE-2025-49014 | 1.8.1 | Heap use-after-free in time formatting functions |
The maintainers have responded to security reports, and the sequence of fixes shows the codebase being hardened release by release. CVE-2026-32316 closes the gap left open when arrays and objects got size limits and strings did not.
