CVE-2026-41257: jq: Signed-int overflow in `stack_reallocate` (jq VM stack)
jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41257?
CVE-2026-41257 has been classified with a high severity due to the potential for signed integer overflow leading to denial of service.
How do I fix CVE-2026-41257?
To fix CVE-2026-41257, upgrade jq to version 1.8.2 or later where the vulnerability has been mitigated.
Which versions of jq are affected by CVE-2026-41257?
CVE-2026-41257 affects jq versions up to and including 1.8.1.
What can happen if CVE-2026-41257 is exploited?
Exploitation of CVE-2026-41257 may lead to a denial of service condition due to the overflow in the jq VM's stack.
Is there a workaround for CVE-2026-41257?
Currently, the best approach to mitigate CVE-2026-41257 is to avoid using deeply nested generator forks or upgrade jq.