CVE-2026-41256 Details
Description
jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.
A vulnerability exists in jq versions through 1.8.1 that involves top-level programs loaded from a file using the -f option. These programs are truncated at the first embedded NUL byte, leading to a mismatch between the compiled prefix and the full buffer. This issue arises because the JSON parser path has been fixed, but the top-level compilation still suffers from the same general bug family as CVE-2026-33948. The vulnerability can be exploited by crafting a filter file that includes a NUL byte followed by an arbitrary suffix, which will be ignored during compilation, leaving jq in an inconsistent state.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jqlang/jq/security/advisories/GHSA-vf2h-chrj-q3fg | CISA-ADP | ExploitVendor Advisory |
| https://github.com/jqlang/jq/security/advisories/GHSA-vf2h-chrj-q3fg | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-158 | Improper Neutralization of Null Byte or NUL Character | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| jqlang jq | <= 1.8.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | Initial Analysis | [email protected] |
| May 11, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | New CVE Received | [email protected] |