CVE-2024-53427: Jqlang Jq

High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days.

decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., "1 NaN123" immediately followed by many more digits).

Affected products

• Jqlang Jq: up to and including 1.7.1

Published 2025-02-26. Last modified 2026-06-17.