CVE-2024-23337 jq has signed integer overflow in jv.c:jvp_array_write
An integer overflow in jq allows attackers to cause a denial of service by assigning values with large indices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-23337?
CVE-2024-23337 is a medium-severity vulnerability in jqlang jq, published on 21 May 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.
Weakness: CWE-190
Which versions are affected by CVE-2024-23337?
It affects 1 product.
Linux distribution packages (9)
jq SUSE:Linux Enterprise Micro 5.1 | All versions | 1.6-150000.3.6.1 |
jq SUSE:Linux Enterprise Micro 5.2 | All versions | 1.6-150000.3.6.1 |
jq SUSE:Linux Enterprise Micro 5.3 | All versions | 1.6-150000.3.6.1 |
jq SUSE:Linux Enterprise Micro 5.4 | All versions | 1.6-150000.3.6.1 |
jq SUSE:Linux Enterprise Micro 5.5 | All versions | 1.6-150000.3.6.1 |
jq SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 1.6-150000.3.6.1 |
jq SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 1.6-150000.3.6.1 |
jq SUSE:Linux Micro 6.0 | All versions | 1.6-4.1 |
jq openSUSE:Leap 15.6 | All versions | 1.6-150000.3.6.1 |
Products include Jqlang Jq.
How do I fix CVE-2024-23337?
Apply the vendor's patch.
Is CVE-2024-23337 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-23337 exists.
Other vulnerabilities in jqlang jq
- CVE-2026-32316 jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow
- CVE-2024-53427 Memory corruption in jq
- CVE-2025-48060 AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt)
- CVE-2023-49355 Memory corruption in n/a
- CVE-2026-49839 jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow
Sources
Also known as ALPINE-CVE-2024-23337, AZL-61967, AZL-61977, BELL-CVE-2024-23337, CLSA-2026-1776354546, DEBIAN-CVE-2024-23337 and 6 more.