CVE-2024-23337

Published: May 21, 2025Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.

Affected (1)

Products: Jqlang: Jq

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jqlang Jq	Up to 1.7.1

Related CWEs

Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

References (4)

https://github.com/jqlang/jq/commit/de21386681c0df0104a99d9d09db23a9b2a78b1e

Source: security-advisories@github.com

Patch

https://github.com/jqlang/jq/issues/3262

Source: security-advisories@github.com

ExploitIssue Tracking

https://github.com/jqlang/jq/security/advisories/GHSA-2q6r-344g-cx46

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/jqlang/jq/security/advisories/GHSA-2q6r-344g-cx46

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor Advisory

Timeline

No history available yet.