CVE catalog

CVE-2026-33948

Severity: Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Published: Apr 13, 2026, 11:51:04 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.26% · Oct 25, 2026

jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	jq	sid	`1.8.2-1`	fixed
Debian	jq	forky	`1.8.2-1`	fixed
Debian	jq	trixie	`1.7.1-6+deb13u3`	fixed
Debian	jq	trixie-security	`1.7.1-6+deb13u4`	fixed
Debian	jq	bookworm	`1.6-2.1+deb12u2`	fixed
Debian	jq	bookworm-security	`1.6-2.1+deb12u3`	fixed
Cpe	jq	Not reported	`1.7.1-3ubuntu0.24.04.2`	fixed
Cpe	libjq-dev	Not reported	`1.7.1-3ubuntu0.24.04.2`	fixed
Cpe	libjq1	Not reported	`1.7.1-3ubuntu0.24.04.2`	fixed
Cpe	jq	Not reported	`2026-04-12`	fixed
Cpe	jq	Not reported	`1.6-2.1+deb12u2`	fixed
Cpe	jq	Not reported	`1.8.2`	fixed
Alpine	jq	3.22	`1.8.2-r0`	fixed
Alpine	jq	3.23	`1.8.2-r0`	fixed
Alpine	jq	3.24	`1.8.2-r0`	fixed
Ubuntu	jq	pro	`1.5+dfsg-2build1`	vulnerable
Ubuntu	jq	pro	`1.6-1`	vulnerable
Ubuntu	jq	pro	`1.6-1ubuntu0.20.04.1`	vulnerable
Ubuntu	jq	pro	`1.6-1ubuntu0.20.04.1+esm1`	vulnerable
Ubuntu	jq	pro	`1.6-1ubuntu0.20.04.1+esm2`	fixed
Ubuntu	jq	22.04	`1.6-2.1ubuntu2`	vulnerable
Ubuntu	jq	22.04	`1.6-2.1ubuntu3`	vulnerable
Ubuntu	jq	22.04	`1.6-2.1ubuntu3.1`	vulnerable
Ubuntu	jq	22.04	`1.6-2.1ubuntu3.2`	fixed
Ubuntu	jq	24.04	`1.6-3`	vulnerable
Ubuntu	jq	24.04	`1.7-1`	vulnerable
Ubuntu	jq	24.04	`1.7.1-2`	vulnerable
Ubuntu	jq	24.04	`1.7.1-3`	vulnerable
Ubuntu	jq	24.04	`1.7.1-3build1`	vulnerable
Ubuntu	jq	24.04	`1.7.1-3ubuntu0.24.04.1`	vulnerable
Ubuntu	jq	24.04	`1.7.1-3ubuntu0.24.04.2`	fixed
Ubuntu	jq	25.10	`1.7.1-3ubuntu1`	vulnerable
Ubuntu	jq	25.10	`1.7.1-6ubuntu1`	vulnerable
Ubuntu	jq	25.10	`1.8.1-3ubuntu1`	vulnerable
Ubuntu	jq	25.10	`1.8.1-3ubuntu1.1`	fixed
Ubuntu	jq	26.04	`1.8.1-3ubuntu1`	vulnerable
Ubuntu	jq	26.04	`1.8.1-4ubuntu1`	vulnerable
Ubuntu	jq	26.04	`1.8.1-4ubuntu2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	jq	source	sid	`1.8.1-5`	not yet assigned	Not reported	[1133921]
Debian	jq	source	forky	`1.8.1-5`	not yet assigned	Not reported	[1133921]
Debian	jq	source	trixie	`1.7.1-6+deb13u2`	not yet assigned	Not reported	[1133921]
Debian	jq	source	bookworm	`1.6-2.1+deb12u2`	not yet assigned	Not reported	[1133921]
Cpe	jq	cpe	Not reported	`1.7.1-3ubuntu0.24.04.2`	Not reported	Not reported	Not reported
Cpe	libjq-dev	cpe	Not reported	`1.7.1-3ubuntu0.24.04.2`	Not reported	Not reported	Not reported
Cpe	libjq1	cpe	Not reported	`1.7.1-3ubuntu0.24.04.2`	Not reported	Not reported	Not reported
Cpe	jq	cpe	Not reported	`2026-04-12`	Not reported	Not reported	Not reported
Cpe	jq	cpe	Not reported	`1.6-2.1+deb12u2`	Not reported	Not reported	Not reported
Cpe	jq	cpe	Not reported	`1.8.2`	Not reported	NVD-CVE-2026-33948	Not reported
Alpine	jq	apk	3.22	`1.8.2-r0`	Not reported	ALPINE-CVE-2026-33948	Not reported
Alpine	jq	apk	3.23	`1.8.2-r0`	Not reported	ALPINE-CVE-2026-33948	Not reported
Alpine	jq	apk	3.24	`1.8.2-r0`	Not reported	ALPINE-CVE-2026-33948	Not reported
Ubuntu	jq	deb	pro	`1.6-1ubuntu0.20.04.1+esm2`	Not reported	UBUNTU-CVE-2026-33948	Not reported
Ubuntu	jq	deb	22.04	`1.6-2.1ubuntu3.2`	Not reported	UBUNTU-CVE-2026-33948	Not reported
Ubuntu	jq	deb	24.04	`1.7.1-3ubuntu0.24.04.2`	Not reported	UBUNTU-CVE-2026-33948	Not reported
Ubuntu	jq	deb	25.10	`1.8.1-3ubuntu1.1`	Not reported	UBUNTU-CVE-2026-33948	Not reported
Ubuntu	jq	deb	26.04	`1.8.1-4ubuntu2`	Not reported	UBUNTU-CVE-2026-33948	Not reported

[Debian bug #1133921]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[jq]Fixed
Details (4)
- 1.6-2.1+deb12u2 · amd64 · bookworm
  Fixed · Fixed: 1.6-2.1+deb12u2
  nvd · jq · debian · bookworm; nvd · jq · debian · 12
- 1.6-2.1+deb12u2 · arm64 · bookworm
  Fixed · Fixed: 1.6-2.1+deb12u2
  nvd · jq · debian · bookworm; nvd · jq · debian · 12
- 1.6-2.1+deb12u2 · amd64 · bookworm-security
  Fixed · Fixed: 1.6-2.1+deb12u2
  nvd · jq · debian · bookworm; nvd · jq · debian · 12
- 1.6-2.1+deb12u2 · arm64 · bookworm-security
  Fixed · Fixed: 1.6-2.1+deb12u2
  nvd · jq · debian · bookworm; nvd · jq · debian · 12
[libjq1]Fixed
Source package: [jq]
Details (4)
- 1.6-2.1+deb12u2 · amd64 · bookworm
  Fixed · Fixed: 1.6-2.1+deb12u2
  nvd · jq · debian · bookworm; nvd · jq · debian · 12
- 1.6-2.1+deb12u2 · arm64 · bookworm
  Fixed · Fixed: 1.6-2.1+deb12u2
  nvd · jq · debian · bookworm; nvd · jq · debian · 12
- 1.6-2.1+deb12u2 · amd64 · bookworm-security
  Fixed · Fixed: 1.6-2.1+deb12u2
  nvd · jq · debian · bookworm; nvd · jq · debian · 12
- 1.6-2.1+deb12u2 · arm64 · bookworm-security
  Fixed · Fixed: 1.6-2.1+deb12u2
  nvd · jq · debian · bookworm; nvd · jq · debian · 12
[libjq-dev]Fixed
Source package: [jq]
Details (4)
- 1.6-2.1+deb12u2 · amd64 · bookworm
  Fixed · Fixed: 1.6-2.1+deb12u2
  nvd · jq · debian · bookworm; nvd · jq · debian · 12
- 1.6-2.1+deb12u2 · arm64 · bookworm
  Fixed · Fixed: 1.6-2.1+deb12u2
  nvd · jq · debian · bookworm; nvd · jq · debian · 12
- 1.6-2.1+deb12u2 · amd64 · bookworm-security
  Fixed · Fixed: 1.6-2.1+deb12u2
  nvd · jq · debian · bookworm; nvd · jq · debian · 12
- 1.6-2.1+deb12u2 · arm64 · bookworm-security
  Fixed · Fixed: 1.6-2.1+deb12u2
  nvd · jq · debian · bookworm; nvd · jq · debian · 12

[Debian 13 (Trixie)]

[jq]Fixed
Details (5)
- 1.7.1-6+deb13u2 · amd64 · trixie
  Fixed · Fixed: 1.7.1-6+deb13u2
  nvd · jq · debian · 13
- 1.7.1-6+deb13u2 · arm64 · trixie
  Fixed · Fixed: 1.7.1-6+deb13u2
  nvd · jq · debian · 13
- 1.7.1-6+deb13u3 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 1.7.1-6+deb13u2
  nvd · jq · debian · 13
- 1.7.1-6+deb13u3 · arm64 · trixie-security
  Fixed · Fixed: 1.7.1-6+deb13u2
  nvd · jq · debian · 13
- 1.7.1-6+deb13u4 · amd64 · trixie-security
  Fixed · Fixed: 1.7.1-6+deb13u2
  nvd · jq · debian · 13
[libjq1]Fixed
Source package: [jq]
Details (5)
- 1.7.1-6+deb13u2 · amd64 · trixie
  Fixed · Fixed: 1.7.1-6+deb13u2
  nvd · jq · debian · 13
- 1.7.1-6+deb13u2 · arm64 · trixie
  Fixed · Fixed: 1.7.1-6+deb13u2
  nvd · jq · debian · 13
- 1.7.1-6+deb13u3 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 1.7.1-6+deb13u2
  nvd · jq · debian · 13
- 1.7.1-6+deb13u3 · arm64 · trixie-security
  Fixed · Fixed: 1.7.1-6+deb13u2
  nvd · jq · debian · 13
- 1.7.1-6+deb13u4 · amd64 · trixie-security
  Fixed · Fixed: 1.7.1-6+deb13u2
  nvd · jq · debian · 13
[libjq-dev]Fixed
Source package: [jq]
Details (5)
- 1.7.1-6+deb13u2 · amd64 · trixie
  Fixed · Fixed: 1.7.1-6+deb13u2
  nvd · jq · debian · 13
- 1.7.1-6+deb13u2 · arm64 · trixie
  Fixed · Fixed: 1.7.1-6+deb13u2
  nvd · jq · debian · 13
- 1.7.1-6+deb13u3 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 1.7.1-6+deb13u2
  nvd · jq · debian · 13
- 1.7.1-6+deb13u3 · arm64 · trixie-security
  Fixed · Fixed: 1.7.1-6+deb13u2
  nvd · jq · debian · 13
- 1.7.1-6+deb13u4 · amd64 · trixie-security
  Fixed · Fixed: 1.7.1-6+deb13u2
  nvd · jq · debian · 13

Observed: Oct 27, 2026, 7:59:09 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]