CVE-2026-54679 — jq: potential integer overflow in jvp_string_append
jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvp_string_append has a chance of integer/multiple overflowing and then causing a massive buffer overrun. …
Published: 2026-06-25 · CVSS: 6.9 · CVSS 4.0
jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvp_string_append has a chance of integer/multiple overflowing and then causing a massive buffer overrun. This vulnerability is fixed in 1.8.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7