CVE-2024-53427 Details
Description
decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., "1 NaN123" immediately followed by many more digits).
A stack-based buffer overflow vulnerability has been identified in JQ version 1.7.1. The issue arises in the decNumberCopy function within decNumber.c, where NaN is incorrectly treated as a numeric value. This flaw can be exploited by using the --slurp option with a specific filter that includes a crafted digit string containing NaN, leading to an out-of-bounds write. The vulnerability was discovered during fuzz testing and can cause undefined behavior, crashes, or potential security risks.
Users are advised to upgrade to JQ version 1.7.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 5, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/Ekkosun/a83870ce7f3b7813b9b462a395e8ad92 | [email protected] | Third Party Advisory |
| https://github.com/jqlang/jq/blob/71c2ab509a8628dbbad4bc7b3f98a64aa90d3297/src/decNumber/decNumber.c#L3375 | [email protected] | Product |
| https://github.com/jqlang/jq/issues/3196 | [email protected] | ExploitIssue TrackingVendor Advisory |
| https://github.com/jqlang/jq/issues/3296 | [email protected] | Issue TrackingVendor Advisory |
| https://github.com/jqlang/jq/security/advisories/GHSA-x6c3-qv5r-7q22 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-843 | Access of Resource Using Incompatible Type ('Type Confusion') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| jqlang jq | <= 1.7.1 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2025 | Initial Analysis | [email protected] |
| Mar 28, 2025 | CVE Modified | [email protected] |
| Mar 2, 2025 | CVE Modified | [email protected] |
| Feb 26, 2025 | New CVE Received | [email protected] |