How severe is CVE-2026-43895?

CVE-2026-43895 has a CVSS 3.x base score of 4.4, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2026-43895 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (5th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-43895?

CVE-2026-43895 affects Jqlang Jq. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-43895?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-43895 have an EU (EUVD) identifier?

Yes. CVE-2026-43895 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-29173.

When was CVE-2026-43895 published?

CVE-2026-43895 was published on 2026-05-11 and last updated on 2026-06-17.

CVE-2026-43895

CVE-2026-43895 is a medium-severity vulnerability in Jqlang Jq with a CVSS 3.x base score of 4.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-20.

Key facts

Severity: Medium (CVSS 3.x base score 4.4)
EPSS exploit prediction: 0% (5th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-29173
Weakness: CWE-20
Affected product: Jqlang Jq
Published: 2026-05-11
Last modified: 2026-06-17

Description

jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens.

Frequently asked questions

What is CVE-2026-43895?: jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens.
How severe is CVE-2026-43895?: CVE-2026-43895 has a CVSS 3.x base score of 4.4, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2026-43895 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (5th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-43895?: CVE-2026-43895 affects Jqlang Jq. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-43895?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-43895 have an EU (EUVD) identifier?: Yes. CVE-2026-43895 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-29173.
When was CVE-2026-43895 published?: CVE-2026-43895 was published on 2026-05-11 and last updated on 2026-06-17.

References

https://github.com/jqlang/jq/security/advisories/GHSA-7q7g-mrq3-phxr

Affected products (1)

cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*

More vulnerabilities in Jqlang Jq

CVE-2026-32316 — High (CVSS 8.2): jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the…
CVE-2024-53427 — High (CVSS 8.1): decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which…
CVE-2025-48060 — High (CVSS 7.5): jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in…
CVE-2023-49355 — High (CVSS 7.5): decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111"…
CVE-2026-49839 — High (CVSS 7.1): jq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-string error into…
CVE-2026-39979 — Medium (CVSS 6.5): jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized()…

All CVEs affecting Jqlang Jq →

Other CWE-20 (Improper Input Validation) vulnerabilities

CVE-2026-48316 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48281 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48277 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48055 — Critical (CVSS 10.0): Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and…
CVE-2026-34910 — Critical (CVSS 10.0): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS…
CVE-2026-33587 — Critical (CVSS 10.0): Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and…

Browse all CWE-20 (Improper Input Validation) vulnerabilities →