jqlang CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM jqlang CVE published 2026-04-13

CVE-2026-39956

The CVE-2026-39956 vulnerability affects the jq command-line JSON processor, specifically versions prior to 1.8.2. This vulnerability allows an attacker to crash jq and potentially achieve a controlled pointer dereference, limited memory read, or probe primitive. The issue arises from the _strindices builtin in jq's src/builtin.c passing arguments directly to jv_string_indexes() without verifying they are [truncated]