Is CVE-2026-39979 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 1%.

What products does CVE-2026-39979 affect?

Tracked products affected include Red Hat Enterprise Linux, Red Hat OpenShift. Check the version you run to see whether it is affected.

How do I fix CVE-2026-39979?

Apply the vendor fix in your normal patch cycle. An official patch or advisory is available. Upgrade affected products to a fixed version.

← All products

CVE-2026-39979

Q: What is CVE-2026-39979?

CVE-2026-39979 is a medium-severity software vulnerability (Out-of-bounds read) with a CVSS score of 6.5. jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buf

MEDIUM severity · CVSS 6.5 · Out-of-bounds read

6.5CVSS MEDIUM

Summary

jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactLow

Integrity impactNone

Availability impactLow

Exploit probability (EPSS)1%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected products we track (2)

Red Hat Enterprise Linux Red Hat OpenShift

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Official patch: https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f ↗

CVE-2026-39979

Summary

Impact & exploitability

Affected products we track (2)

Recommendation

Additional information