CVE-2023-49355: Jqlang Jq

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" input. NOTE: this is not the same as CVE-2023-50246. The CVE-2023-50246 71c2ab5 reference mentions -10E-1000010001, which is not in normalized scientific notation.

Affected products

• Jqlang Jq: version 1.7-37-g88f01a7 only

Published 2023-12-11. Last modified 2026-06-17.