CVE-2026-41256

jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.

• CWE-158

• https://github.com/jqlang/jq/security/advisories/GHSA-vf2h-chrj-q3fgExploit, Vendor Advisory
• https://github.com/jqlang/jq/security/advisories/GHSA-vf2h-chrj-q3fgExploit, Vendor Advisory

Published

May 11, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4125The WPMK Block plugin for WordPress is vulnerable to Stored …6.4
• CVE-2026-41250Taiga is a project management platform for startups and agil…5.7
• CVE-2026-41252xrdp is an open source RDP server. Versions 0.10.6 and prior…9.8
• CVE-2026-41253In iTerm2 through 3.6.9, displaying a .txt file can cause co…7.8
• CVE-2026-41254Little CMS (lcms2) through 2.18 has an integer overflow in C…7.5
• CVE-2026-41255CKAN is an open-source DMS (data management system) for powe…6.1
• CVE-2026-41257jq is a command-line JSON processor. In 1.8.1 and earlier, t…5.5
• CVE-2026-41258OpenMRS is an open source electronic medical record system p…9.1
• CVE-2026-41259Mastodon is a free, open-source social network server based …7.5
• CVE-2026-4126The Table Manager plugin for WordPress is vulnerable to Sens…4.3
• CVE-2026-41263Traefik is an HTTP reverse proxy and load balancer. Prior to…3.7
• CVE-2026-41264Flowise is a drag & drop user interface to build a customize…9.8