CVE-2023-49355: jqlang jq Out-of-bounds Write
Vulnerability summary
CVE-2023-49355 is a high (CVSS 7.5) Out-of-bounds Write vulnerability in jqlang jq. EPSS estimates a 1.17% chance of exploitation in the next 30 days, higher than 67.4% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Timeline
- 11-12-2023PublishedVulnerability first disclosed.
- 09-10-2024Last modifiedVulnerability information updated.
Description
decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" input. NOTE: this is not the same as CVE-2023-50246. The CVE-2023-50246 71c2ab5 reference mentions -10E-1000010001, which is not in normalized scientific notation.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.17%
Chance of exploitation in the next 30 days
Percentile
67%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.17% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundBug Reports
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- jq< 1.7.1-1
Jqlang1 product
- jq1.7-37-g88f01a7
Ubuntu1 product
- jq< 1.7.1-2
3 vendors · 3 products
