CVE-2026-39956: 
NixOS vulnerability analysis and mitigation

CVE-2026-39956 is a type confusion and missing runtime type check vulnerability in the _strindices builtin of jq, the popular command-line JSON processor. Introduced in commits after 69785bf77f86e2ea1b4a20ca86775916889e91c9, the flaw allows an attacker who can supply untrusted jq filters to crash the process or achieve a controlled pointer dereference and limited memory read primitive. Affected versions are those up to and including jq 1.8.1 built with -DNDEBUG (standard release builds); the issue was patched in commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper input validation (CWE-1287) combined with type confusion (CWE-843) and out-of-bounds read (CWE-125). The f_string_indexes() wrapper in src/builtin.c passes both of its arguments directly to jv_string_indexes() in src/jv.c without first verifying they are strings; jv_string_indexes() relies solely on assert() guards that are compiled out in release builds using -DNDEBUG. When a non-string value (e.g., a number) is passed, jv_string_value() treats the value's u.ptr union field as a valid jvp_string *, enabling either an immediate crash or — by crafting a numeric value whose IEEE-754 double bit pattern maps to a chosen address — a controlled pointer dereference and limited memory probe. Because default jq builds use decnum, a plain numeric literal does not directly control u.ptr, but arithmetic such as (TARGET_ADDR + 0) routes through jv_number(double) and stores the IEEE-754 bits in the same union field (GitHub Advisory, Patch Commit).

Successful exploitation can crash the jq process (denial of service) or allow an attacker to probe and read limited regions of process memory, potentially disclosing sensitive data processed by jq (e.g., secrets, tokens, or configuration values present in JSON being filtered). The confidentiality impact is low and integrity is unaffected; however, availability is rated high due to the trivial crash vector. Any pipeline, API, or automation system that evaluates untrusted jq filters against a release build is within scope (GitHub Advisory, Red Hat Bugzilla).

1. Identify a vulnerable target: Locate a system or service that evaluates user-supplied or attacker-influenced jq filters using a release build of jq (version ≤ 1.8.1 compiled with -DNDEBUG). This could be a web application, CI/CD pipeline, or CLI tool that passes untrusted input to jq.
2. Crash the process (DoS): Supply the filter _strindices(0) to the jq invocation. In a release build, the missing type check causes jv_string_value() to dereference an invalid pointer, resulting in a SIGSEGV and process crash.
3. Craft a controlled pointer dereference (memory probe): To target a specific memory address, use Python to compute the IEEE-754 double representation of the desired 64-bit pointer value using struct.pack. Construct a jq filter that performs arithmetic on this value (e.g., (TARGET_DOUBLE + 0) | _strindices("x")) so that the result is stored as a jv_number double, placing the target address in the u.ptr union field.
4. Trigger the read primitive: Submit the crafted filter to the vulnerable jq process. The jv_string_value() call will treat the crafted pointer as a jvp_string * and attempt to read a string length and data from that address, potentially leaking memory contents or confirming address validity via crash behavior.
5. Exfiltrate or analyze results: Observe the process output, error messages, or crash signals to infer memory layout or extract data present at the probed address (GitHub Advisory).

• Process: jq process terminating with SIGSEGV (signal 11) or Segmentation fault messages, especially when processing filters containing _strindices with non-string arguments.
• Logs: Application or system logs showing unexpected jq crashes or core dumps; entries referencing _strindices with numeric arguments in filter audit logs.
• Network/Application: Unusual or malformed jq filter strings submitted via API endpoints or configuration interfaces, particularly those containing _strindices(0) or arithmetic expressions designed to produce specific floating-point bit patterns.
• File System: Core dump files (core, core.<pid>) generated by the jq process in the working directory or system core dump location, indicating abnormal termination (GitHub Advisory).

The fix is available in commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03, which adds explicit runtime type checks to f_string_indexes() before calling jv_string_indexes(). Downstream distributions including Ubuntu (USN-8202-1, USN-8202-2, USN-8202-3) and Amazon Linux 2023 (ALAS2023-2026-1815) have released updated packages. If immediate patching is not possible, restrict the ability to evaluate untrusted jq filters in automated or user-facing systems, and avoid compiling jq with -DNDEBUG in production environments so that assertion checks remain active (Patch Commit, GitHub Advisory, Red Hat Bugzilla).

The vulnerability was disclosed via the jq GitHub Security Advisory by maintainer itchyny on April 12, 2026, and was also reported to the oss-security mailing list. Red Hat tracked it via Bugzilla with medium severity. Ubuntu issued multiple security notices (USN-8202-1 through USN-8202-3), and Microsoft's MSRC acknowledged the CVE in the context of CBL-Mariner/Azure Linux. Community reaction has been measured given the medium CVSS score and the requirement for user interaction, with no significant social media amplification observed (GitHub Advisory, oss-sec, Red Hat Bugzilla).