Description (CNA)
jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| jqlang / jq | affected <= 1.8.1 |
CWE
CWE-190, CWE-787
References
ADP enrichment
No English description supplied.