What’s Vulnerable › Vulnerabilities

CVE-2026-41257: jq: Signed-int overflow in `stack_reallocate` (jq VM stack)

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-05-11 · updated 2026-10-26
• Weakness: CWE-190

Description

jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.

Affected products

• jqlang jq: through 1.8.1

References

• https://github.com/jqlang/jq/security/advisories/GHSA-4jm8-m363-4539
• https://github.com/jqlang/jq/security/advisories/GHSA-4jm8-m363-4539

Get alerted when CVE-2026-41257 or the next vulnerability affects your stack