Skip to content
Fencer Intel
high 7.5

CVE-2016-4074 json

The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and application crash) via a cr…

published 2016-05-06 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-5075

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
5.4%
EPSS 5.4% chance of exploitation in 30 days, percentile 92%
public exploits
0
none known

Summary

The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted JSON file. This issue has been fixed in jq 1.6_rc1-r0.

Patch / fix

  • jq_project jq 1.6rc2
  • jqlang jq 1.6rc2
  • jq Debian 14, Debian 13, Debian 12 1.5+dfsg-1.1

debian advisories DEBIAN-CVE-2016-4074

  • jq Ubuntu Pro 14.04 LTS 1.3-1.1ubuntu1.1+esm3
  • jq Ubuntu Pro 16.04 LTS 1.5+dfsg-1ubuntu0.1+esm2

ubuntu advisories UBUNTU-CVE-2016-4074

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • jq Enterprise Storage 4 1.5-3.5.7

suse advisories SUSE-SU-2017:2950-1

  • jq openSUSE Tumbleweed 1.6-2.9
  • jq Package Hub 12 SP1 1.5-5.1

opensuse advisories openSUSE-SU-2024:10881-1openSUSE-SU-2017:2833-1openSUSE-SU-2017:2834-1

  • jq Alpine 3.24, Alpine 3.23, Alpine 3.22 +14 more 1.6_rc1-r0
  • jq Alpine 3.4 1.5-r2
  • jq Alpine 3.6, Alpine 3.5 1.5-r4
  • jq Alpine 3.7 1.5-r5

alpine advisories ALPINE-CVE-2016-4074

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • jq CBL-Mariner 2.0 1.5-6

azure linux advisories AZL-6505

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-4074 updated cvss 2.6

jq: stack exhaustion via jv_dump_term() function

  • Red Hat Enterprise Linux 8 jq Red Hat Enterprise Linux OpenStack Platform 6 (Juno) jq Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) jq Red Hat OpenStack Platform 8 (Liberty) jq Red Hat OpenStack Platform 9 (Mitaka) jq
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 9 jq
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

5.38% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/stedolan/jq/issues/1136 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added fix version.