{
  "cveId": "CVE-2023-50246",
  "url": "https://patchblox.com/security/cve/CVE-2023-50246",
  "summary": "CVE-2023-50246 is fixed in jq on 1 platform, first by DEBIAN-CVE-2023-50246, released December 13, 2023. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "jq: This update for jq fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2015-8863: heap buffer overflow in toke...",
  "description": "This update for jq fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2015-8863: heap buffer overflow in tokenadd() function (bsc#976992).\n- CVE-2023-50246: improper memory handling can lead to a heap buffer overflow in \u0060decNumberToString\u0060 (bsc#1218034).\n- CVE-2023-50268: stack-based buffer overflow in builds using decNumber (bsc#1218038).\n- CVE-2024-53427: stack-buffer-overflow in the decNumberCopy function in decNumber.c (bsc#1238078).\n- CVE-2025-9403: reachable assertion in run_jq_tests() (bsc#1248600).\n- CVE-2026-33948: CLI input parsing allows validation bypass via embedded NUL bytes (bsc#1262043).\n- CVE-2026-40164: predictable hash collisions can lead to a denial of service (bsc#1262072).\n- CVE-2026-40612: jv_contains recurses into nested arrays/objects with no depth limit and can cause a stack overflow\n  (bsc#1265060).\n- CVE-2026-41256: embedded NUL truncates top-level jq programs loaded with -f and can lead to execution of unintended\n  programs (bsc#1265061).\n- CVE-2026-41257: integer overflow in \u0060stack_reallocate\u0060 can lead to memory corruption and DoS (bsc#1265062).\n- CVE-2026-43894: signed integer overflow in \u0060decNumber\u0060 can lead to out-of-bounds memory write (bsc#1265070).\n- CVE-2026-43895: embedded NUL bytes in import paths can lead to policy bypass and sensitive information disclosure\n  (bsc#1265071).\n- CVE-2026-43896: unbounded recursion in \u0060jv_object_merge_recursive()\u0060 can lead to C stack exhaustion and a process\n  crash (bsc#1265075).\n- CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules \u0060include\u0060 each other can lead\n  to stack exhaustion and process crash (bsc#1265076).\n- CVE-2026-47770: stack overflow in deep structural equality (bsc#1269221).\n- CVE-2026-49839: \u0060--rawfile\u0060 invalid-state reuse after \u0060String too long\u0060 can lead to a heap buffer overflow\n  (bsc#1269220).\n- CVE-2026-54679: integer overflow in \u0060jvp_string_append\u0060 can lead to a buffer overrun on 32-bit systems (bsc#1269390).\n\nChanges for jq:\n\nUpdate to version 1.7.1:\n\n * Make the default background color more suitable for bright\n backgrounds.\n * Allow passing the inline jq script after --.\n * Fix possible uninitialised value dereference if jq_init() fails\n * Simplify paths/0 and paths/1.\n * Reject U\u002B001F in string literals.\n * Remove unused nref accumulator in block_bind_library.\n * Remove a bunch of unused variables, and useless assignments.\n * main.c: Remove unused EXIT_STATUS_EXACT option.\n * Actually use the number correctly casted from double to int as\n index.\n * src/builtin.c: remove unnecessary jv_copy-s in\n type_error/type_error2.\n * Remove undefined behavior caught by LLVM 10 UBSAN.\n * Convert decnum to binary64 (double) instead of decimal64.\n This makes jq behave like the JSON specification suggests and\n more similar to other languages.\n * Fix memory leaks on invalid input for ltrimstr/1 and\n rtrimstr/1.\n * Fix memory leak on failed get for setpath/2.\n * Fix nan from json parsing also for nans with payload that\n start with \u0027n\u0027.\n * Allow carriage return characters in comments.\n * Generate links in the man page.\n * Add extern C for C\u002B\u002B.\n * Make object key color configurable using JQ_COLORS environment\n variable.\n * Change the default color of null to Bright Black.\n * Respect NO_COLOR environment variable to disable color output.\n * Improved --help output. Now mentions all options and nicer\n order.\n * Fix multiple issues of exit code using --exit-code/-e option.\n * Add --raw-output0 for NUL (zero byte) separated output.\n * Fix assert crash and validate JSON for --jsonarg.\n * Remove deprecated --argfile option.\n * Use decimal number literals to preserve precision. Comparison\n operations respects precision but arithmetic operations might\n truncate.\n * Adds new builtin pick(stream) to emit a projection of the\n input object or array.\n * Adds new builtin debug(msgs) that works like debug but applies\n a filter on the input before writing to stderr.\n * Adds new builtin scan($re; $flags). Was documented but not\n implemented.\n * Adds new builtin abs to get absolute value. This potentially\n allows the literal value of numbers to be preserved as length\n and fabs convert to float.\n * Allow if without else-branch. When skipped the else-branch\n will be . (identity).\n * Allow use of $binding as key in object literals.\n * Allow dot between chained indexes when using .[\u0027index\u0027]\n * Allow dot for chained value iterator .[], .[]?\n * Fix try/catch catches more than it should.\n * Speed up and refactor some builtins, also remove\n scalars_or_empty/0.\n * Now halt and halt_error exit immediately instead of continuing\n to the next input.\n * Fix issue converting string to number after previous convert\n error.\n * Fix issue representing large numbers on some platforms causing\n invalid JSON output.\n * Fix deletion using assigning empty against arrays.\n * Allow keywords to be used as binding name in more places.\n * Allow using nan as NaN in JSON.\n * Expose a module\u0027s function names in modulemeta.\n * Fix contains/1 to handle strings with NUL.\n * Fix stderr/0 to output raw text without any decoration.\n * Fix nth/2 to emit empty on index out of range.\n * Fix implode to not assert and instead replace invalid unicode\n codepoints.\n * Fix indices/1 and rindex/1 in case of overlapping matches in\n strings.\n * Fix sub/3 to resolve issues involving global search-and-replace\n (gsub) operations.\n * Fix empty regular expression matches.\n * Fix overflow exception of the modulo operator.\n * Fix string multiplication by 0 (and less than 1) to emit empty\n string.\n * Fix segfault when using libjq and threads.\n * Fix constant folding of division and reminder with zero\n divisor.\n * Fix error/0, error/1 to throw null error.\n * Simpler and faster transpose.\n * Simple and efficient implementation of walk/1.\n * Remove deprecated filters leaf_paths, recurse_down.",
  "published": "2023-12-13T21:15:08Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00508,
  "epssPercentile": 0.43636,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "jq",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1.7.1-1",
      "fix": "DEBIAN-CVE-2023-50246",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-50246",
      "released": "2023-12-13T21:15:08Z"
    },
    {
      "platform": "linux",
      "product": "jq",
      "release": "Debian 14",
      "fixedVersion": "1.7.1-1",
      "fix": "DEBIAN-CVE-2023-50246",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-50246",
      "released": "2023-12-13T21:15:08Z"
    },
    {
      "platform": "linux",
      "product": "jq",
      "release": "sles 15.6",
      "fixedVersion": "1.7.1-150000.3.25.1",
      "fix": "SUSE-SU-2026:4275-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4275-1",
      "released": "2026-09-21T07:33:03Z"
    },
    {
      "platform": "linux",
      "product": "jq",
      "release": "sles 15.7",
      "fixedVersion": "1.7.1-150000.3.25.1",
      "fix": "SUSE-SU-2026:4275-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4275-1",
      "released": "2026-09-21T07:33:03Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}