Improper Null Termination in jq - CVE-2026-33948

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU125839

Improper Null Termination in jq - CVE-2026-33948

Published: April 13, 2026 / Updated: August 19, 2026


Vulnerability identifier: #VU125839
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33948
CWE-ID: CWE-170
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to embedded-NUL truncation in jq CLI JSON input path. A remote attacker can cause validation bypass on the system.


Affected software

jq
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
Ubuntu
Basesystem Module
openEuler
Anolis OS
Fedora
LANTIME Operating System Firmware (LTOS)
jq (Ubuntu package)
jq-debuginfo
jq-debugsource
libjq1
libjq1-debuginfo
libjq-devel
jq
jq-help
jq-devel
jq-doc

How to mitigate CVE-2026-33948

Install update from vendor's website.

jq - update to 1.8.2
LANTIME Operating System Firmware (LTOS) - update to 7.10.013
jq (Ubuntu package) - addressed in versions 1.3-1.1ubuntu1.1+esm4, 1.5+dfsg-1ubuntu0.1+esm4, 1.5+dfsg-2ubuntu0.1~esm2, 1.5+dfsg-2ubuntu0.1~esm3, 1.6-1ubuntu0.20.04.1+esm2, 1.6-1ubuntu0.20.04.1+esm3, 1.6-2.1ubuntu3.2, 1.7.1-3ubuntu0.24.04.2, 1.8.1-3ubuntu1.1, 1.8.1-4ubuntu2
jq-debuginfo - update to 1.6-150000.3.15.1
jq-debugsource - update to 1.6-150000.3.15.1
libjq1 - update to 1.6-150000.3.15.1
libjq1-debuginfo - update to 1.6-150000.3.15.1
libjq-devel - update to 1.6-150000.3.15.1
jq - update to 1.6-150000.3.15.1
jq-debuginfo - addressed in versions 1.8.0-3, 1.8.0-4
jq - addressed in versions 1.8.0-3, 1.8.0-4
jq-help - addressed in versions 1.8.0-3, 1.8.0-4
jq-devel - addressed in versions 1.8.0-3, 1.8.0-4
jq-debugsource - addressed in versions 1.8.0-3, 1.8.0-4
jq-doc - update to 1.8.1-6
jq-devel - update to 1.8.1-6
jq - update to 1.8.1-6
jq - update to 1.8.2-4.fc45

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins