CVE-2026-54679: Jqlang Jq

Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days.

jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvp_string_append has a chance of integer/multiple overflowing and then causing a massive buffer overrun. This vulnerability is fixed in 1.8.2.

Affected products

• Jqlang Jq: before 1.8.2 (fixed in 1.8.2)

Published 2026-06-25. Last modified 2026-06-26.