Description
The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted JSON file. This issue has been fixed in jq 1.6_rc1-r0.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jq | 1.5+dfsg-1.1 | — |
| Debian 13 | jq | 1.5+dfsg-1.1 | — |
| Debian 12 | jq | 1.5+dfsg-1.1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | jq | 1.5+dfsg-1ubuntu0.1+esm2 | USN-4787-1 |
| Ubuntu Pro 14.04 LTS | jq | 1.3-1.1ubuntu1.1+esm3 | USN-4787-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 12 SP1 | jq | 1.5-5.1 | openSUSE-SU-2017:2834-1, openSUSE-SU-2017:2833-1 |
| SUSE Enterprise Storage 4 | jq | 1.5-3.5.7 | SUSE-SU-2017:2950-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | jq | 1.6-2.9 | openSUSE-SU-2024:10881-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | jq | 1.6_rc1-r0 | — |
| Alpine v3.23 | jq | 1.6_rc1-r0 | — |
| Alpine v3.22 | jq | 1.6_rc1-r0 | — |
| Alpine v3.21 | jq | 1.6_rc1-r0 | — |
| Alpine v3.20 | jq | 1.6_rc1-r0 | — |
Show 16 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | jq | 1.6_rc1-r0 | — |
| Alpine v3.18 | jq | 1.6_rc1-r0 | — |
| Alpine v3.17 | jq | 1.6_rc1-r0 | — |
| Alpine v3.16 | jq | 1.6_rc1-r0 | — |
| Alpine v3.15 | jq | 1.6_rc1-r0 | — |
| Alpine v3.14 | jq | 1.6_rc1-r0 | — |
| Alpine v3.13 | jq | 1.6_rc1-r0 | — |
| Alpine v3.12 | jq | 1.6_rc1-r0 | — |
| Alpine v3.11 | jq | 1.6_rc1-r0 | — |
| Alpine v3.10 | jq | 1.6_rc1-r0 | — |
| Alpine v3.9 | jq | 1.6_rc1-r0 | — |
| Alpine v3.8 | jq | 1.6_rc1-r0 | — |
| Alpine v3.7 | jq | 1.5-r5 | — |
| Alpine v3.6 | jq | 1.5-r4 | — |
| Alpine v3.5 | jq | 1.5-r4 | — |
| Alpine v3.4 | jq | 1.5-r2 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | jq | 1.5-6 | — |
Advisories 5
- USN-4787-1 jq vulnerability Ubuntu Security Notices (USN) · Jun 29, 2026
- SUSE-SU-2017:2950-1 Security update for jq SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10881-1 jq-1.6-2.9 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2017:2834-1 Security update for jq SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2017:2833-1 Security update for jq SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [oss-security] 20160424 Re: CVE Request: jq: stack exhaustion using jv_dump_term() function mailing-list
- https://github.com/stedolan/jq/issues/1136
- [oss-security] 20160424 CVE Request: jq: stack exhaustion using jv_dump_term() function mailing-list
- https://github.com/stedolan/jq/
- https://github.com/NixOS/nixpkgs/pull/18908
- https://github.com/hashicorp/consul/issues/10263