CVE-2026-39979 jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers
An out-of-bounds read in jq's error handling allows attackers to disclose memory or crash the process via malformed JSON input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-39979?
CVE-2026-39979 is a medium-severity vulnerability in Redhat Enterprise Linux, published on 13 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.
Weakness: CWE-125
Which versions are affected by CVE-2026-39979?
It affects 14 products.
Products include Jqlang Jq, Redhat Ai Inference Server, Redhat Ansible Automation Platform, Redhat Ceph Storage, Redhat Codeready Linux Builder, Redhat Codeready Linux Builder Eus and 8 more.
How do I fix CVE-2026-39979?
Apply the vendor's patch.
Is CVE-2026-39979 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-39979 exists.
Other vulnerabilities in Redhat Enterprise Linux
- CVE-2026-32316 jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow
- CVE-2024-53427 Memory corruption in jq
- CVE-2025-48060 AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt)
- CVE-2023-49355 Memory corruption in n/a
- CVE-2026-49839 jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow
Sources
Also known as ALPINE-CVE-2026-39979, AZL-82931, BELL-CVE-2026-39979, DEBIAN-CVE-2026-39979, ECHO-8163-2cab-0c0f, GHSA-2hhh-px8h-355p.