CVE-2026-32316

A flaw was found in jq, a command-line JSON processor. An attacker can exploit an integer overflow vulnerability by crafting queries that produce extremely large strings. This causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, leading to a drastically undersized memory buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap-based buffer overflow. This can result in a Denial of Service (DoS) by crashing the process or potentially allow for further exploitation through heap corruption.

This Moderate impact vulnerability in jq, a command-line JSON processor, allows for a Denial of Service or potential arbitrary code execution. The flaw occurs when jq processes untrusted queries that generate excessively large strings, leading to an integer overflow and heap-based buffer overflow. Red Hat products that utilize jq for processing JSON data are affected if they handle untrusted jq queries.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid processing untrusted or unvalidated JSON input with the jq utility. Ensure that any scripts or automated processes utilizing jq only operate on trusted data sources. Restricting the execution of jq to trusted users and environments can also reduce exposure.