The CVE-2026-39956 vulnerability affects the jq command-line JSON processor, specifically versions prior to 1.8.2. This vulnerability allows an attacker to crash jq and potentially achieve a controlled pointer dereference, limited memory read, or probe primitive. The issue arises from the _strindices builtin in jq's src/builtin.c passing arguments directly to jv_string_indexes() without verifying they are [truncated]
CVE-2026-32316 is an integer overflow vulnerability in jq, a command-line JSON processor, through version 1.8.1. The vulnerability exists in the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation. This results in a heap buffer overflow, cla [truncated]
