CVE-2024-23337 — jq has signed integer overflow in jv.c:jvp_array_write

Affected: jqlang jq

jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.

USN-7657-1 — jq vulnerabilities

Affected: Ubuntu:22.04:LTS: jq, Ubuntu:24.04:LTS: jq

It was discovered that jq incorrectly handled certain values when parsing JSON data. A remote attacker could possibly use this issue to cause jq to crash, resulting in a denial of service. (CVE-2024-23337)

It was discovered that jq incorrectly handled NaN values when parsing JSON data. A remote attacker could possibly use this issue to cause jq to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS, and Ubuntu 25.04. (CVE-2024-53427)

It was discovered that jq incorrectly handled certain values when parsing JSON data. A remote attacker could use this issue to cause jq to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-48060)

Most recent entries from all

CVE-2024-23337 — jq has signed integer overflow in jv.c:jvp_array_write

USN-7657-1 — jq vulnerabilities