Improper Input Validation Affecting libjq-devel package, versions <1.7.1-160000.3.1
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-SLES1600-LIBJQDEVEL-17978091
- published15 Jul 2026
- disclosed7 Jul 2026
Introduced: 7 Jul 2026
NewCVE-2026-33948 (opens in a new tab)How to fix?
Upgrade SLES:16.0.0 libjq-devel to version 1.7.1-160000.3.1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream libjq-devel package and not the libjq-devel package as distributed by SLES.
See How to fix? for SLES:16.0.0 relevant fixed versions and status.
jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.