Validation bypass via embedded-NUL input truncation
Published Apr 13, 2026 · Updated Apr 13, 2026
Improper input validation in jqlang jq 1.8.1 and earlier allows attackers to bypass JSON validation via embedded NUL bytes. jq_util_input_read_more uses strlen on the buffer returned by fgets, passes only the prefix before the first NUL to the parser, and silently excludes trailing bytes. Exploitation requires a workflow that treats jq as a validator but later forwards, stores, or acts on the original bytes, allowing downstream processing of unchecked data.
Summary
What happened
Improper input validation in jqlang jq 1.8.1 and earlier allows attackers to bypass JSON validation via embedded NUL bytes. jq_util_input_read_more uses strlen on the buffer returned by fgets, passes only the prefix before the first NUL to the parser, and silently excludes trailing bytes. Exploitation requires a workflow that treats jq as a validator but later forwards, stores, or acts on the original bytes, allowing downstream processing of unchecked data.
The record
- CVE
- CVE-2026-33948
- Published
- Apr 13, 2026
- Updated
- Apr 13, 2026
- Vendor
- jqlang
- Product
- jq
- Classifications
- CWE-170, CWE-20
- Attack vector
- network
- Privileges
- unauthenticated
Timeline
How it unfolded
- Apr 13, 2026CVE publishedPublication date reported by the CVE source.
- Apr 13, 2026Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=< 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b
What conditions does exploitation require?
What is affected?
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Public exploit references
- Embedded-NUL CLI JSON input proof of conceptproof of concept · demonstrated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo