CVE-2026-39979: 
NixOS vulnerability analysis and mitigation

CVE-2026-39979 is an out-of-bounds read vulnerability in the jv_parse_sized() API of libjq, the library component of the popular command-line JSON processor jq. The flaw affects all jq versions up to and including 1.8.1 (commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f). It was published on April 13, 2026, and assigned a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause (CWE-125: Out-of-bounds Read) lies in the error-handling path of jv_parse_sized_custom_flags(). The function accepts a counted buffer via (const char *string, int length), but when a parse error occurs, it constructs the error message using jv_string_fmt("%s (while parsing '%s')", ..., string), which passes the raw pointer to vsnprintf() with a %s format specifier. This causes the runtime to read memory until a NUL terminator is found, completely ignoring the caller-supplied length parameter. The fix, applied in commit 2f09060, changes the format specifier to %.*s and passes length as the precision argument, bounding the read to the intended buffer (GitHub Advisory, Fix Commit). The vulnerability is reachable by any application embedding libjq and calling jv_parse_sized() with untrusted, non-NUL-terminated input; the standard jq CLI is not directly affected because it passes NUL-terminated strings internally (GitHub Advisory).

Successful exploitation can result in memory disclosure — adjacent heap or stack contents beyond the input buffer may be included in the error message string returned to the caller — or process termination due to an invalid memory access, depending on the memory layout at the time of the read. The confidentiality impact is limited to the process's own memory space (no privilege escalation or remote code execution), and there is no integrity impact. Applications that log or expose jq error messages to external parties are at elevated risk of leaking sensitive in-memory data (GitHub Advisory, Red Hat Bugzilla).

A proof-of-concept exploit (poc_issue1_jv_parse_sized_oob.c) is publicly available in the GitHub Security Advisory, demonstrating memory disclosure by allocating a 1-byte non-NUL-terminated buffer containing { and passing it to jv_parse_sized() (GitHub Advisory). No in-the-wild exploitation has been observed as of the time of this report. The EPSS score is approximately 0.042%, reflecting low probability of active exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify a target application: Find a service or application that embeds libjq and calls jv_parse_sized() with externally supplied, non-NUL-terminated input buffers (e.g., a web API that processes user-provided JSON using libjq directly).
2. Craft malformed JSON: Prepare a malformed JSON payload (e.g., a single { character) in a buffer that is NOT NUL-terminated — for example, allocated with malloc(1) with buf[0] = '{'.
3. Submit the payload: Pass the buffer and its length (e.g., length = 1) to the target application's code path that invokes jv_parse_sized(buf, 1).
4. Trigger the out-of-bounds read: The parse fails, and the error-handling path calls jv_string_fmt("%s ...", string), which reads past the end of the 1-byte buffer until a NUL byte is found in adjacent memory.
5. Capture disclosed memory: The resulting error message string contains bytes from memory beyond the intended buffer. If the application returns or logs this error message, the attacker can read the disclosed content to extract sensitive in-memory data (GitHub Advisory).

• Logs: Application error logs containing unexpectedly long or garbled JSON parse error messages from libjq, particularly messages of the form ... (while parsing '...') with non-JSON binary or ASCII content beyond the original input length.
• Process Behavior: Unexpected process crashes (segmentation faults or SIGBUS signals) in applications using libjq when processing untrusted JSON input, potentially indicating a memory access violation triggered by the out-of-bounds read.
• File System: Presence of the PoC file poc_issue1_jv_parse_sized_oob.c or compiled binaries derived from it on systems where jq is installed (GitHub Advisory).

The fix is available in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f in the jqlang/jq repository. Downstream distributions have released patched packages: Red Hat Enterprise Linux 8 (RHSA-2026:16252), RHEL 9 (RHSA-2026:16693), RHEL 10 (RHSA-2026:16692), and multiple EUS/SAP variants; Ubuntu (USN-8202-1, USN-8202-2, USN-8202-3); Amazon Linux 2023 (ALAS2023-2026-1815); and AlmaLinux/Rocky Linux equivalents (Red Hat Bugzilla). As a workaround for applications that cannot be immediately patched, developers using libjq should ensure all buffers passed to jv_parse_sized() are explicitly NUL-terminated, or validate and sanitize input before passing it to the API. Upgrading to a patched package version is the recommended remediation.

The vulnerability was disclosed via the GitHub Security Advisory program (GHSA-2hhh-px8h-355p) and reported to the oss-security mailing list (oss-sec 2026/q2/141). Red Hat triaged it as high severity and issued numerous errata across RHEL versions. Microsoft also acknowledged the CVE in their update guide. No significant public researcher commentary or social media discussion beyond standard vulnerability tracking has been observed.