PT-2025-22366 · Jq+9 · Jq+9

Published 2025-05-21 · Updated 2026-03-29 · CVE-2024-23337

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions jq versions up to and including 1.7.1

Description The issue arises from an integer overflow when assigning a value using an index of 2147483647, which is the signed integer limit. This causes a denial of service.

Recommendations For versions up to and including 1.7.1, update to a version that includes the patch from commit de21386681c0df0104a99d9d09db23a9b2a78b1e to resolve the issue.

Exploit

Fix

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALSA-2025:10585

ALSA-2025:10618

ALSA-2025_10585

ALSA-2025_10618

ALT-PU-2025-7731

AZL-61967

AZL-61977

BDU:2025-06692

CESA-2025_10618

CVE-2024-23337

ECHO-9730-832C-E99F

GHSA-2Q6R-344G-CX46

INFSA-2025_10585

INFSA-2025_10618

OESA-2025-1809

OPENSUSE-SU-2025:15233-1

RHSA-2025:10585

RHSA-2025:10613

RHSA-2025:10615

RHSA-2025:10616

RHSA-2025:10618

RHSA-2025:10619

RHSA-2025:10620

RHSA-2025:10621

RHSA-2025:10622

RHSA-2025:12882

RHSA-2025_10585

RHSA-2025_10618

SUSE-SU-2025:02384-1

SUSE-SU-2025:20506-1

SUSE-SU-2025:20591-1

SUSE-SU-2025_02384-1

USN-7657-1

USN-7657-2

Affected Products

Alt Linux

Almalinux

Centos

Debian

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

Jq

References · 65

• 🔥 https://github.com/jqlang/jq/issues/3262 · Exploit
• 🔥 https://github.com/jqlang/jq/security/advisories/GHSA-2q6r-344g-cx46 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23337.json · Exploit
• https://github.com/jqlang/jq/commit/de21386681c0df0104a99d9d09db23a9b2a78b1e · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:20506-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-23337 · Security Note
• https://bdu.fstec.ru/vul/2025-06692 · Security Note
• https://osv.dev/vulnerability/OESA-2025-1809 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2025:10618 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02384-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:20591-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2024-23337 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-61977 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15233-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23337 · Security Note