CVE-2026-33948: jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input

Overview

Severity

N/A

Exploit Status

Not Exploited

Patch Tuesday

2026-Apr

Released

2026-04-17

Last Updated

2026-04-24

EPSS Score

0.26% (percentile: 17.4%)

Affected Products (2)

Open Source Software

• cbl2 jq 1.6-5 on CBL Mariner 2.0

Mariner

• azl3 jq 1.7.1-4 on Azure Linux 3.0

Revision History

• 2026-04-17: Information published.
• 2026-04-18: Information published.
• 2026-04-24: Information published.