Description
jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 `void* p = malloc(sz);`. As of time of publication, no patched versions are available.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jqlang | jq | <= 1.7.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jq | 1.8.0-1 | — |
| Debian 13 | jq | 1.7.1-6+deb13u1 | — |
| Debian 12 | jq | 1.6-2.1+deb12u1 | — |
| Debian 11 | jq | 1.6-2.1+deb11u1 | DLA-4307-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | jq | 1.8.1-3ubuntu1 | — |
| Ubuntu 25.10 | jq | 1.8.1-3ubuntu1 | — |
| Ubuntu 24.04 LTS | jq | 1.7.1-3ubuntu0.24.04.1 | USN-7657-1 |
| Ubuntu 22.04 LTS | jq | 1.6-2.1ubuntu3.1 | USN-7657-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | jq | 1.6-1ubuntu0.20.04.1+esm1 | USN-7657-2 |
| Ubuntu Pro 18.04 LTS | jq | 1.5+dfsg-2ubuntu0.1~esm1 | USN-7657-2 |
| Ubuntu Pro 16.04 LTS | jq | 1.5+dfsg-1ubuntu0.1+esm3 | USN-7657-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | jq +1 | 1.7.1-8.el10_0.1 | RHSA-2025:12882 |
| RHEL 9 | jq +1 | 1.6-17.el9_6.2 | RHSA-2025:10585 |
| RHEL 8 | jq +1 | 1.6-11.el8_10 | RHSA-2025:10618 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | jq +1 | 1.6-16.el9_4.1 | RHSA-2025:10613 |
| RHEL 9.2 E4S | jq | 1.6-15.el9_2.2 | RHSA-2025:10615 |
| RHEL 9.0 E4S | jq | 1.6-12.el9_0.1 | RHSA-2025:10616 |
| RHEL 8.8 TUS | jq | 1.6-6.el8_8.3 | RHSA-2025:10619 |
| RHEL 8.8 E4S | jq | 1.6-6.el8_8.3 | RHSA-2025:10619 |
| RHEL 8.6 TUS | jq | 1.6-3.el8_6.1 | RHSA-2025:10620 |
| RHEL 8.6 EUS Long Life | jq | 1.6-3.el8_6.1 | RHSA-2025:10620 |
| RHEL 8.6 E4S | jq | 1.6-3.el8_6.1 | RHSA-2025:10620 |
| RHEL 8.6 AUS | jq | 1.6-3.el8_6.1 | RHSA-2025:10620 |
| RHEL 8.4 AUS | jq | 1.5-12.el8_4.4 | RHSA-2025:10621 |
| RHEL 8.2 AUS | jq | 1.5-12.el8_2.1 | RHSA-2025:10622 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | jq +1 | 1.6-17.el9_6.2 | ALSA-2025:10585 |
| AlmaLinux 8 | jq +1 | 1.6-11.el8_10 | ALSA-2025:10618 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | jq | 1.7.1-8.el10_0.1 | RLSA-2025:12882 |
| Rocky Linux 9 | jq | 1.6-17.el9_6.2 | RLSA-2025:10585 |
| Rocky Linux 8 | jq | 1.6-11.el8_10 | RLSA-2025:10618 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | jq | 1.6-150000.3.9.1 | SUSE-SU-2025:02915-1 |
| SLES 15 SP6 | jq | 1.6-150000.3.9.1 | SUSE-SU-2025:02915-1 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | jq | 1.7.1-160000.3.1 | SUSE-SU-2026:22566-1 |
| SLES 16.0 | jq | 1.7.1-160000.3.1 | SUSE-SU-2026:22566-1 |
| SLE Micro 6.2 | jq | 1.7.1-160000.3.1 | SUSE-SU-2026:22545-1 |
| SLE Micro 6.1 | jq | 1.7.1-slfo.1.1_2.1 | SUSE-SU-2025:20591-1 |
| SLE Micro 6.0 | jq | 1.6-5.1 | SUSE-SU-2025:20655-1 |
| SLE Micro 5.5 | jq | 1.6-150000.3.9.1 | SUSE-SU-2025:02915-1 |
| SLE Micro 5.4 | jq | 1.6-150000.3.9.1 | SUSE-SU-2025:02915-1 |
| SLE Micro 5.3 | jq | 1.6-150000.3.9.1 | SUSE-SU-2025:02915-1 |
| SLE Micro 5.2 | jq | 1.6-150000.3.9.1 | SUSE-SU-2025:02915-1 |
| SLE Micro 5.1 | jq | 1.6-150000.3.9.1 | SUSE-SU-2025:02915-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | jq | 1.8.1-1.1 | openSUSE-SU-2025:15233-1 |
| openSUSE Leap 16.0 | jq | 1.7.1-160000.3.1 | openSUSE-SU-2026:21248-1 |
| openSUSE Leap 15.6 | jq | 1.6-150000.3.9.1 | SUSE-SU-2025:02915-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | jq | 1.8.0-r0 | — |
| Alpine v3.23 | jq | 1.8.0-r0 | — |
| Alpine v3.22 | jq | 1.8.0-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | jq | 1.7.1-4 | — |
| Azure Linux 2 (CBL-Mariner) | jq | 1.6-4 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | jq +1 | 1.7.1-8.el10_0.1 | ELSA-2025-12882 |
| Oracle Linux 9 | jq +1 | 1.6-17.el9_6.2 | ELSA-2025-10585 |
| Oracle Linux 8 | jq +1 | 1.6-11.el8_10 | ELSA-2025-10618 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
leorivass/jq-els-backport-cve-2025-48060 ★ 1 · Nov 16, 2025
Backported the upstream fix for CVE-2025-48060 (heap buffer overflow in jv_string_empty) to jq 1.6.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 34
- ALSA-2025:10585 Moderate: jq security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:10618 Moderate: jq security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:12882 Red Hat Security Advisory: jq security update Red Hat Security Advisories (RHSA) · Sep 1, 2026
- RHSA-2025:10621 Red Hat Security Advisory: jq security update Red Hat Security Advisories (RHSA) · Sep 1, 2026
- RHSA-2025:10622 Red Hat Security Advisory: jq security update Red Hat Security Advisories (RHSA) · Sep 1, 2026
- RHSA-2025:10620 Red Hat Security Advisory: jq security update Red Hat Security Advisories (RHSA) · Sep 1, 2026
- RHSA-2025:10619 Red Hat Security Advisory: jq security update Red Hat Security Advisories (RHSA) · Sep 1, 2026
- RHSA-2025:10618 Red Hat Security Advisory: jq security update Red Hat Security Advisories (RHSA) · Sep 1, 2026
- RHSA-2025:10615 Red Hat Security Advisory: jq security update Red Hat Security Advisories (RHSA) · Sep 1, 2026
- RHSA-2025:10616 Red Hat Security Advisory: jq security update Red Hat Security Advisories (RHSA) · Sep 1, 2026
- RHSA-2025:10613 Red Hat Security Advisory: jq security update Red Hat Security Advisories (RHSA) · Sep 1, 2026
- RHSA-2025:10585 Red Hat Security Advisory: jq security update Red Hat Security Advisories (RHSA) · Sep 1, 2026
- SUSE-SU-2026:22566-1 Security update for jq SUSE / openSUSE Security Updates · Jul 15, 2026
- WID-SEC-2025-1480 Red Hat Enterprise Linux (jq): Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jul 14, 2026
- SUSE-SU-2026:22545-1 Security update for jq SUSE / openSUSE Security Updates · Jul 14, 2026
- openSUSE-SU-2026:21248-1 Security update for jq SUSE / openSUSE Security Updates · Jul 9, 2026
- USN-7657-2 jq vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-7657-1 jq vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- openSUSE-SU-2025:15233-1 jq-1.8.1-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20591-1 Security update for jq SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02915-1 Security update for jq SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20655-1 Security update for jq SUSE / openSUSE Security Updates · Mar 23, 2026
- DLA-4307-1 jq - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2025-1905 IBM QRadar SIEM Komponente: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 4, 2026
- NCSC-2026-0022 Kwetsbaarheden verholpen in Oracle Communications producten NCSC-NL (Netherlands) · Jan 21, 2026
- WID-SEC-2026-0153 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2025-2424 IBM Rational Team Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 28, 2025
- RLSA-2025:12882 Moderate: jq security update Rocky Linux Security Advisories · Oct 8, 2025
- RLSA-2025:10585 Moderate: jq security update Rocky Linux Security Advisories · Oct 7, 2025
- VDE-2025-077 Phoenix Contact: Two vulnerabilities in the jq JSON processor utilized by FL MGUARD 110x devices CERT@VDE · Sep 9, 2025
- ELSA-2025-12882 Moderate: jq security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 5, 2025
- RLSA-2025:10618 Moderate: jq security update Rocky Linux Security Advisories · Jul 29, 2025
- ELSA-2025-10585 Moderate: jq security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 8, 2025
- ELSA-2025-10618 Moderate: jq security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 8, 2025