CVE-2015-8863

Critical

Published: 06/05/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.

Risk Assessment

Attackers can exploit this vulnerability to remotely crash the application, potentially leading to service downtime.

Recommendation

It is recommended to update jq to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.

Original NVD description (English source)

Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.