CVE-2026-54679

jq: potential integer overflow in jvp_string_append PUBLISHED

Description (CNA)

jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvp_string_append has a chance of integer/multiple overflowing and then causing a massive buffer overrun. This vulnerability is fixed in 1.8.2.

Affected (CNA)

Vendor / product	Versions
jqlang / jq	affected < 1.8.2

CWE

CWE-190

References

https://github.com/jqlang/jq/security/advisories/GHSA-29gj-222p-j7vx

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.