jq - Debian Package Tracker

general

source: jq (main)
version: 1.8.1-6
maintainer: ChangZhuo Chen (陳昌倬) (DMD)
arch: any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.6-2.1
o-o-sec: 1.6-2.1+deb11u2
oldstable: 1.6-2.1+deb12u1
stable: 1.7.1-6+deb13u2
testing: 1.8.1-5
unstable: 1.8.1-6

versioned links

1.6-2.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.6-2.1+deb11u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.6-2.1+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.7.1-6+deb13u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.8.1-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.8.1-6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

jq (4 bugs: 0, 3, 1, 0)
libjq-dev
libjq1

action needed

A new upstream version is available: 1.8.2rc1 high

A new upstream version 1.8.2rc1 is available, you should consider packaging it.

Created: 2026-04-25 Last update: 2026-05-26 00:30

6 security issues in trixie high

There are 6 open security issues in trixie.

2 important issues:

CVE-2026-43894: jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack buffer, and then writes ≈715 million 16-bit units (≈1.4 GiB) at an offset 1.43 GiB below the stack frame. The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).
CVE-2026-43895: jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens.

4 issues left for the package maintainer to handle:

CVE-2026-41256: (needs triaging) jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.
CVE-2026-41257: (needs triaging) jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.
CVE-2026-43896: (needs triaging) jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects.
CVE-2026-44777: (needs triaging) jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two otherwise valid modules include each other.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-05-11 Last update: 2026-05-25 09:30

6 security issues in forky high

There are 6 open security issues in forky.

6 important issues:

CVE-2026-41256: jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.
CVE-2026-41257: jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.
CVE-2026-43894: jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack buffer, and then writes ≈715 million 16-bit units (≈1.4 GiB) at an offset 1.43 GiB below the stack frame. The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).
CVE-2026-43895: jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens.
CVE-2026-43896: jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects.
CVE-2026-44777: jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two otherwise valid modules include each other.

Created: 2026-05-11 Last update: 2026-05-25 09:30

1 security issue in bullseye high

There is 1 open security issue in bullseye.

1 important issue:

CVE-2026-43894: jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack buffer, and then writes ≈715 million 16-bit units (≈1.4 GiB) at an offset 1.43 GiB below the stack frame. The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).

Created: 2026-05-11 Last update: 2026-05-25 09:30

12 security issues in bookworm high

There are 12 open security issues in bookworm.

2 important issues:

CVE-2026-43894: jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack buffer, and then writes ≈715 million 16-bit units (≈1.4 GiB) at an offset 1.43 GiB below the stack frame. The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).
CVE-2026-43895: jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens.

10 issues left for the package maintainer to handle:

CVE-2026-32316: (needs triaging) jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5.
CVE-2026-33947: (needs triaging) jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(), and delpaths_sorted() in jq's src/jv_aux.c use unbounded recursion whose depth is controlled by the length of a caller-supplied path array, with no depth limit enforced. An attacker can supply a JSON document containing a flat array of ~65,000 integers (~200 KB) that, when used as a path argument by a trusted jq filter, exhausts the C call stack and crashes the process with a segmentation fault (SIGSEGV). This bypass works because the existing MAX_PARSING_DEPTH (10,000) limit only protects the JSON parser, not runtime path operations where arrays can be programmatically constructed to arbitrary lengths. The impact is denial of service (unrecoverable crash) affecting any application or service that processes untrusted JSON input through jq's setpath, getpath, or delpaths builtins. This issue has been addressed in commit fb59f1491058d58bdc3e8dd28f1773d1ac690a1f.
CVE-2026-33948: (needs triaging) jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.
CVE-2026-39956: (needs triaging) jq is a command-line JSON processor. In commits after 69785bf77f86e2ea1b4a20ca86775916889e91c9, the _strindices builtin in jq's src/builtin.c passes its arguments directly to jv_string_indexes() without verifying they are strings, and jv_string_indexes() in src/jv.c relies solely on assert() checks that are stripped in release builds compiled with -DNDEBUG. This allows an attacker to crash jq trivially with input like _strindices(0), and by crafting a numeric value whose IEEE-754 bit pattern maps to a chosen pointer, achieve a controlled pointer dereference and limited memory read/probe primitive. Any deployment that evaluates untrusted jq filters against a release build is vulnerable. This issue has been patched in commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03.
CVE-2026-39979: (needs triaging) jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.
CVE-2026-40164: (needs triaging) jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n), turning any jq expression into an O(n²) operation and causing significant CPU exhaustion. This affected common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more practical to exploit than existing heap overflow issues since it required only a small payload. This issue has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784.
CVE-2026-41256: (needs triaging) jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.
CVE-2026-41257: (needs triaging) jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.
CVE-2026-43896: (needs triaging) jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects.
CVE-2026-44777: (needs triaging) jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two otherwise valid modules include each other.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-04-13 Last update: 2026-05-25 09:30

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 2-day delay is over. Check why.

Created: 2026-05-19 Last update: 2026-05-26 04:33

1 new commit since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 6390e7ca0590ac807d368e82403d64dd4a068458
Author: ChangZhuo Chen (陳昌倬) <czchen@debian.org>
Date:   Tue May 19 17:48:25 2026 +0800

    Add not-needed to upstream patches

Created: 2026-05-16 Last update: 2026-05-25 17:17

debian/patches: 13 patches to forward upstream low

Among the 17 debian patches available in version 1.8.1-6 of the package, we noticed the following issues:

13 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2026-04-17 Last update: 2026-05-17 08:30

testing migrations

excuses:
- Migration status for jq (1.8.1-5 to 1.8.1-6): Waiting for test results or another package, or too young (no action required now - check later)
- Issues preventing migration:
- ∙ ∙ Autopkgtest for jose/14-2: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- ∙ ∙ Autopkgtest for kcov/43+dfsg-3: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered
- ∙ ∙ Autopkgtest for python-jq/1.11.0-1: amd64: Pass, arm64: Pass, i386: Pass, ppc64el: Pass, riscv64: Test triggered, s390x: Pass
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/j/jq.html
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- ∙ ∙ 9 days old (needed 2 days)
- Not considered

news

[rss feed]

[2026-05-25] Accepted jq 1.6-2.1+deb11u2 (source) into oldoldstable-security (Andreas Henriksson)
[2026-05-16] Accepted jq 1.8.1-6 (source) into unstable (ChangZhuo Chen (陳昌倬)) (signed by: ChangZhuo Chen)
[2026-05-04] Accepted jq 1.7.1-6+deb13u2 (source) into proposed-updates (Debian FTP Masters) (signed by: ChangZhuo Chen)
[2026-04-22] jq 1.8.1-5 MIGRATED to testing (Debian testing watch)
[2026-04-17] Accepted jq 1.8.1-5 (source) into unstable (ChangZhuo Chen (陳昌倬)) (signed by: ChangZhuo Chen)
[2025-09-28] jq 1.8.1-4 MIGRATED to testing (Debian testing watch)
[2025-09-23] Accepted jq 1.8.1-4 (source) into unstable (ChangZhuo Chen (陳昌倬)) (signed by: ChangZhuo Chen)
[2025-09-21] Accepted jq 1.6-2.1+deb11u1 (source) into oldoldstable-security (Thorsten Alteholz)
[2025-08-13] jq 1.8.1-3 MIGRATED to testing (Debian testing watch)
[2025-07-12] Accepted jq 1.8.1-3 (source) into unstable (ChangZhuo Chen (陳昌倬)) (signed by: ChangZhuo Chen)
[2025-07-12] Accepted jq 1.6-2.1+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: ChangZhuo Chen)
[2025-07-09] Accepted jq 1.8.1-2 (source) into unstable (ChangZhuo Chen (陳昌倬)) (signed by: ChangZhuo Chen)
[2025-07-09] jq 1.7.1-6+deb13u1 MIGRATED to testing (Debian testing watch)
[2025-07-08] Accepted jq 1.7.1-6+deb13u1 (source) into testing-proposed-updates (ChangZhuo Chen (陳昌倬)) (signed by: ChangZhuo Chen)
[2025-07-07] Accepted jq 1.8.1-1 (source) into unstable (ChangZhuo Chen (陳昌倬)) (signed by: ChangZhuo Chen)
[2025-06-09] Accepted jq 1.8.0-1 (source) into unstable (ChangZhuo Chen (陳昌倬)) (signed by: ChangZhuo Chen)
[2025-05-29] jq 1.7.1-6 MIGRATED to testing (Debian testing watch)
[2025-05-26] Accepted jq 1.7.1-6 (source) into unstable (ChangZhuo Chen (陳昌倬)) (signed by: ChangZhuo Chen)
[2025-04-22] jq 1.7.1-5 MIGRATED to testing (Debian testing watch)
[2025-04-12] Accepted jq 1.7.1-5 (source) into unstable (ChangZhuo Chen (陳昌倬)) (signed by: ChangZhuo Chen)
[2025-04-09] Accepted jq 1.7.1-4 (source) into unstable (ChangZhuo Chen (陳昌倬)) (signed by: ChangZhuo Chen)
[2024-04-06] jq 1.7.1-3 MIGRATED to testing (Debian testing watch)
[2024-02-29] Accepted jq 1.7.1-3 (source) into unstable (ChangZhuo Chen (陳昌倬)) (signed by: ChangZhuo Chen)
[2023-12-21] jq 1.7.1-2 MIGRATED to testing (Debian testing watch)
[2023-12-17] Accepted jq 1.7.1-2 (source) into unstable (ChangZhuo Chen (陳昌倬)) (signed by: ChangZhuo Chen)
[2023-12-15] Accepted jq 1.7.1-1 (source) into unstable (ChangZhuo Chen (陳昌倬)) (signed by: ChangZhuo Chen)
[2023-09-18] jq 1.7-1 MIGRATED to testing (Debian testing watch)
[2023-09-12] Accepted jq 1.7-1 (source) into unstable (ChangZhuo Chen (陳昌倬)) (signed by: ChangZhuo Chen)
[2023-08-26] jq 1.6-3 MIGRATED to testing (Debian testing watch)
[2023-08-20] Accepted jq 1.6-3 (source) into unstable (ChangZhuo Chen (陳昌倬)) (signed by: ChangZhuo Chen)

bugs [bug history graph]

all: 4
RC: 0
I&N: 3
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
screenshots
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.8.1-4ubuntu1
2 bugs