CVE-2024-23337: Jqlang Jq Integer Overflow DoS Vulnerability

CVE-2024-23337 Overview

CVE-2024-23337 is an integer overflow vulnerability [CWE-190] in jq, the widely used command-line JSON processor developed by jqlang. The flaw affects versions up to and including 1.7.1. It occurs when a value is assigned using an array index of 2147483647, the signed 32-bit integer limit. The overflow triggers a denial of service in the jq process. The upstream project addressed the issue in commit de21386681c0df0104a99d9d09db23a9b2a78b1e.

Critical Impact
An attacker who can influence a jq filter or JSON input processed by an application can crash the process, disrupting automation pipelines, log processors, and CI/CD workflows that rely on jq.

Affected Products

jqlang jq versions up to and including 1.7.1
Applications and containers bundling vulnerable jq binaries
CI/CD, log-processing, and shell pipelines that invoke jq on untrusted JSON or filters

Discovery Timeline

2025-05-21 - CVE-2024-23337 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23337

Vulnerability Analysis

The defect resides in the jq value manipulation code in src/jv.c and src/jv_aux.c. When code paths compute a target array position, the index is treated as a signed 32-bit integer. Supplying 2147483647 (INT_MAX) as an index causes arithmetic on that value to overflow into a negative number.

The overflow propagates into internal allocation and slot-writing logic in jvp_array_write and slice manipulation routines used by jv_array_set. The corrupted arithmetic produces invalid memory operations, terminating the process. Because jq frequently runs against untrusted or externally sourced JSON, the flaw is reachable in many real-world data pipelines.

Root Cause

The root cause is missing bounds validation on the requested array index before it is used in offset arithmetic. The patched code compares the index against (INT_MAX >> 2) - jvp_array_offset(j) and rejects requests that would overflow. The fix also propagates jv_is_valid(t) checks through slice loops so that failure short-circuits further mutation.

Attack Vector

Exploitation requires the target to process attacker-controlled input. This includes a hostile jq filter, a JSON document that drives an index expression, or a program built on libjq that forwards untrusted data into array assignments. No authentication is required, but user interaction (executing the filter) is expected in typical deployments. Successful exploitation produces process termination and denial of service without impacting confidentiality or integrity.

// Patch excerpt from src/jv.c - bounds check added before jvp_array_write
     jv_free(val);
     return jv_invalid_with_msg(jv_string("Out of bounds negative array index"));
   }
+  if (idx > (INT_MAX >> 2) - jvp_array_offset(j)) {
+    jv_free(j);
+    jv_free(val);
+    return jv_invalid_with_msg(jv_string("Array index too large"));
+  }
   // copy/free of val,j coalesced
   jv* slot = jvp_array_write(&j, idx);
   jv_free(*slot);

Source: jqlang/jq commit de21386

// Patch excerpt from src/jv_aux.c - propagate jv_is_valid through slice loops
         if (slice_len < insert_len) {
           // array is growing
           int shift = insert_len - slice_len;
-          for (int i = array_len - 1; i >= end; i--) {
+          for (int i = array_len - 1; i >= end && jv_is_valid(t); i--) {
             t = jv_array_set(t, i + shift, jv_array_get(jv_copy(t), i));
           }
         } else if (slice_len > insert_len) {
           // array is shrinking
           int shift = slice_len - insert_len;
-          for (int i = end; i < array_len; i++) {
+          for (int i = end; i < array_len && jv_is_valid(t); i++) {
             t = jv_array_set(t, i - shift, jv_array_get(jv_copy(t), i));
           }
-          t = jv_array_slice(t, 0, array_len - shift);
+          if (jv_is_valid(t))
+            t = jv_array_slice(t, 0, array_len - shift);
         }
-        for (int i=0; i < insert_len; i++) {
+        for (int i = 0; i < insert_len && jv_is_valid(t); i++) {
           t = jv_array_set(t, start + i, jv_array_get(jv_copy(v), i));
         }
         jv_free(v);

Source: jqlang/jq commit de21386

Detection Methods for CVE-2024-23337

Indicators of Compromise

Unexpected termination or crash signals from jq processes handling external JSON input
Presence of array index values at or near 2147483647 (INT_MAX) in JSON payloads or filter strings
Repeated restarts of pipelines, services, or containers that shell out to jq

Detection Strategies

Inventory hosts and container images for jq binaries with version <= 1.7.1 using package manager queries such as jq --version
Enable core-dump and abnormal-exit logging for services that invoke jq and correlate crashes with the JSON payload processed
Scan CI/CD pipelines and shell scripts for jq filters that accept untrusted index parameters

Monitoring Recommendations

Log the exit codes of processes wrapping jq and alert on non-zero terminations tied to specific inputs
Track deployed jq versions across endpoints and container registries using software bill of materials (SBOM) tooling
Alert on inbound JSON payloads containing extremely large integer array indices at API gateways or log ingest points

How to Mitigate CVE-2024-23337

Immediate Actions Required

Upgrade jq to a build that includes commit de21386681c0df0104a99d9d09db23a9b2a78b1e on all hosts, containers, and build images
Rebuild and redeploy container images that bundle jq to pull the fixed binary
Audit applications embedding libjq and rebuild them against the patched library

Patch Information

The fix is committed upstream in the jqlang project. Refer to the GitHub Security Advisory GHSA-2q6r-344g-cx46 and the upstream patch commit for full technical details. Distributions maintaining jq packages should backport the change to any release still shipping 1.7.1 or earlier.

Workarounds

Validate JSON inputs and filter arguments to reject array indices greater than a safe application-defined maximum
Run jq under a supervised process wrapper that restarts on abnormal exit to preserve pipeline availability
Isolate jq execution in sandboxed containers with resource limits to contain denial-of-service impact

bash

# Verify the installed jq version and update using the OS package manager
jq --version

# Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade jq

# RHEL/Alma/Rocky
sudo dnf upgrade jq

# Alpine (containers)
apk add --upgrade jq

# Build from source with the upstream patch
git clone https://github.com/jqlang/jq.git
cd jq
git checkout de21386681c0df0104a99d9d09db23a9b2a78b1e
autoreconf -i && ./configure && make && sudo make install