What’s Vulnerable › Vulnerabilities

CVE-2024-23337: jq has signed integer overflow in jv.c:jvp_array_write

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-05-21 · updated 2026-06-17
• Weakness: CWE-190

Description

jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.

Affected products

• jqlang jq: through 1.7.1

References

• https://github.com/jqlang/jq/commit/de21386681c0df0104a99d9d09db23a9b2a78b1e
• https://github.com/jqlang/jq/issues/3262
• https://github.com/jqlang/jq/security/advisories/GHSA-2q6r-344g-cx46
• https://github.com/jqlang/jq/security/advisories/GHSA-2q6r-344g-cx46

Get alerted when CVE-2024-23337 or the next vulnerability affects your stack