CVE-2026-32316

{
  "id": "CVE-2026-32316",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-13T18:16:29.420",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5."
    },
    {
      "lang": "es",
      "value": "jq es un procesador JSON de línea de comandos. Existe una vulnerabilidad de desbordamiento de entero hasta la versión 1.8.1 dentro de las funciones jvp_string_append() y jvp_string_copy_replace_bad, donde la concatenación de cadenas con una longitud combinada que excede los 2^31 bytes causa un desbordamiento de entero sin signo de 32 bits en el cálculo del tamaño de asignación del búfer, lo que resulta en un búfer de montículo drásticamente subdimensionado. Las operaciones de copia de memoria subsiguientes escriben entonces los datos completos de la cadena en este búfer subdimensionado, causando un desbordamiento de búfer basado en montículo clasificado como CWE-190 (Desbordamiento de entero) que conduce a CWE-122 (Desbordamiento de búfer basado en montículo). Cualquier sistema que evalúe consultas jq no confiables se ve afectado, ya que un atacante puede bloquear el proceso o potencialmente lograr una explotación adicional a través de la corrupción del montículo al elaborar consultas que producen cadenas extremadamente grandes. La causa raíz es la ausencia de verificación de límites de tamaño de cadena, a diferencia de los arreglos y objetos que ya tienen límites de tamaño. El problema ha sido abordado en el commit e47e56d226519635768e6aab2f38f0ab037c09e5."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "jqlang",
          "product": "jq",
          "versions": [
            {
              "version": "< e47e56d226519635768e6aab2f38f0ab037c09e5",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-13T18:56:45.829031Z",
          "id": "CVE-2026-32316",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        },
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "1.8.1",
              "matchCriteriaId": "2026D0D9-8A88-43D4-9995-CF7928D9FFB8"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/jqlang/jq/commit/e47e56d226519635768e6aab2f38f0ab037c09e5",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/jqlang/jq/security/advisories/GHSA-q3h9-m34w-h76f",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2026/10/msg00034.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}