CVE-2026-39979

CVE-2026-39979 affects jq’s libjq jv_parse_sized(): the error path formats input with %s, reading past the caller-provided length for non-NUL-terminated buffers. This can cause an out-of-bounds read in malformed input, potentially enabling memory disclosure or process termination. The issue is pa...