{"answers":{"affected":"It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32316 exists.","fix":"Apply the vendor's patch.","what":"CVE-2026-32316 is a high-severity vulnerability in jqlang jq, published on 13 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-32316 and fix it if it is affected.\n\nWhat it is: CVE-2026-32316 is a high-severity vulnerability in jqlang jq, published on 13 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32316 exists.\n\nAffected product: jqlang jq. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-32316/ (Markdown: https://insights.sbomify.com/CVE-2026-32316/index.md)","id":"CVE-2026-32316","markdown":"https://insights.sbomify.com/CVE-2026-32316/index.md","name":"CVE-2026-32316","record":{"aliases":["ALPINE-CVE-2026-32316","AZL-82922","BELL-CVE-2026-32316","CLSA-2026-1777322146","DEBIAN-CVE-2026-32316","ECHO-a148-c5c1-3e42","GHSA-q3h9-m34w-h76f","UBUNTU-CVE-2026-32316","USN-8202-2"],"analysis":{"component_type":"developer_tool","fix_type":"patch","impacts":["denial_of_service","code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"JSON processor","requires_auth":"none","summary":"An integer overflow in jq allows heap buffer overflows when processing large strings, potentially leading to crashes or code execution.","user_interaction":"not_required","vuln_class":"integer_overflow"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"jq","vendor":"jqlang"}],"cvss":{"score":8.2,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"cwes":[{"id":"CWE-190","name":"Integer Overflow or Wraparound"},{"id":"CWE-122","name":"Heap-based Buffer Overflow"}],"description":"jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow","id":"CVE-2026-32316","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"integer_overflow","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"Cryptomator for Android: Tampered vault configuration allows MITM attack on Hub API","id":"CVE-2026-32317"},"packages":[],"prev":{"headline":"motionEye: World-Readable Configuration File Exposes Admin Password Hash","id":"CVE-2026-32315"},"products":["jq"],"published":"2026-04-13","related":[{"cvss_score":8.1,"headline":"Memory corruption in jq","id":"CVE-2024-53427","kev_date_added":null,"published":"2025-02-26"},{"cvss_score":7.7,"headline":"AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt)","id":"CVE-2025-48060","kev_date_added":null,"published":"2025-05-21"},{"cvss_score":7.5,"headline":"Memory corruption in n/a","id":"CVE-2023-49355","kev_date_added":null,"published":"2023-12-11"},{"cvss_score":7.1,"headline":"jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow","id":"CVE-2026-49839","kev_date_added":null,"published":"2026-06-25"},{"cvss_score":6.9,"headline":"jq: potential integer overflow in jvp_string_append","id":"CVE-2026-54679","kev_date_added":null,"published":"2026-06-25"},{"cvss_score":6.9,"headline":"jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers","id":"CVE-2026-39979","kev_date_added":null,"published":"2026-04-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-16","vendors":["jqlang"]},"summary":"An integer overflow in jq allows heap buffer overflows when processing large strings, potentially leading to crashes or code execution.","url":"https://insights.sbomify.com/CVE-2026-32316/"}