CVE-2026-54679: jq: potential integer overflow in jvp_string_append
jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvpstringappend has a chance of integer/multiple overflowing and then causing a massive buffer overrun. This vulnerability is fixed in 1.8.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jqto a version that resolves this vulnerability.Fixed in 1.8.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54679?
The severity of CVE-2026-54679 is rated as medium with a score of 6.9 on the CVSS scale.
How do I fix CVE-2026-54679?
CVE-2026-54679 can be fixed by upgrading jq to version 1.8.2 or later.
What type of vulnerability is CVE-2026-54679?
CVE-2026-54679 is classified as an integer overflow vulnerability that can lead to a buffer overflow.
On which systems does CVE-2026-54679 affect jq?
CVE-2026-54679 affects jq specifically on 32-bit systems.
What happens if CVE-2026-54679 is exploited?
If exploited, CVE-2026-54679 may lead to a massive buffer overrun, potentially resulting in arbitrary code execution.