CVE-2023-50246: jq has heap-buffer-overflow vulnerability in the function decToString in decNumber.c
Vulnerability summary
CVE-2023-50246 is a medium (CVSS 6.2) vulnerability in jqlang jq. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 43.4% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6.2, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 13-12-2023PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
jq is a command-line JSON processor. Version 1.7 is vulnerable to heap-based buffer overflow. Version 1.7.1 contains a patch for this issue.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · AlpineEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated6.2MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
0.51%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.51% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundJq
Maturity: poc
Weaknesses
CWE · root cause- CWE-120Buffer Copy without Checking Size of InputThe product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
- CWE-122Heap-based Buffer OverflowThe product writes past the end of a buffer that was allocated on the heap.
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Known conditions: local access, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Alpine1 product
- jq< 1.7.1-r0
Debian1 product
- jq< 1.7.1-1
Jqlang1 product
- jq= 1.7 | 1.7 | 1.7:rc1 | 1.7:rc2
Ubuntu1 product
- jq< 1.7.1-2
4 vendors · 4 products
References
8 links- github.com/jqlang/jq/security/advisories/GHSA-686w-5m7m-54vcX Refsource CONFIRMREPORTExploitVendor Advisory
