CVE-2026-39956

{"id": "CVE-2026-39956", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39956", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T15:34:20.696741Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "jqlang", "product": "jq", "versions": [{"status": "affected", "version": "< 1.8.2"}]}]}], "published": "2026-04-13T23:16:27.653", "references": [{"url": "https://github.com/jqlang/jq/commit/fdf8ef0f0810e3d365cdd5160de43db46f57ed03", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/jqlang/jq/security/advisories/GHSA-6gc3-3g9p-xx28", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/jqlang/jq/security/advisories/GHSA-6gc3-3g9p-xx28", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-476"}, {"lang": "en", "value": "CWE-843"}]}], "descriptions": [{"lang": "en", "value": "jq is a command-line JSON processor. Prior to version 1.8.2, the _strindices builtin in jq's src/builtin.c passes its arguments directly to jv_string_indexes() without verifying they are strings, and jv_string_indexes() in src/jv.c relies solely on assert() checks that are stripped in release builds compiled with -DNDEBUG. This allows an attacker to crash jq trivially with input like _strindices(0), and by crafting a numeric value whose IEEE-754 bit pattern maps to a chosen pointer, achieve a controlled pointer dereference and limited memory read/probe primitive. Any deployment that evaluates untrusted jq filters against a release build is vulnerable. This issue has been patched in commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03, which is part of version 1.8.2."}, {"lang": "es", "value": "jq es un procesador JSON de l\u00ednea de comandos. En commits posteriores a 69785bf77f86e2ea1b4a20ca86775916889e91c9, la funci\u00f3n _strindices incorporada en src/builtin.c de jq pasa sus argumentos directamente a jv_string_indexes() sin verificar que sean cadenas, y jv_string_indexes() en src/jv.c se basa \u00fanicamente en comprobaciones assert() que se eliminan en las compilaciones de lanzamiento compiladas con -DNDEBUG. Esto permite a un atacante bloquear jq trivialmente con una entrada como _strindices(0), y al elaborar un valor num\u00e9rico cuyo patr\u00f3n de bits IEEE-754 se mapea a un puntero elegido, lograr una desreferencia de puntero controlada y una primitiva limitada de lectura/sondeo de memoria. Cualquier despliegue que eval\u00fae filtros jq no confiables contra una compilaci\u00f3n de lanzamiento es vulnerable. Este problema ha sido parcheado en el commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "268F5CFD-46C6-4090-A7CD-F85927DE3B70", "versionEndExcluding": "2026-04-08", "versionStartIncluding": "2026-04-02"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}