CVE-2023-49355

What it actually does

One-byte out-of-bounds write in decToString within the decNumber library triggered by a crafted decimal value in non-normalized scientific notation.

Why it matters to the business

Processing untrusted data with jq can cause the tool or dependent applications to crash, interrupting data transformation pipelines and scripts.

How an attack unfolds

An attacker supplies input containing the specially crafted decimal string to jq running on the command line or invoked as a library; the decToString function performs the out-of-bounds write during number formatting.

How to fix it

Upgrade jq to a version containing a fix for the decNumber out-of-bounds write; if no patched release is available, validate and restrict input formats before passing data to jq.

How to confirm the fix worked

Replay the triggering input []-1.2e-1111111111 against the updated binary under AddressSanitizer or equivalent memory checker and confirm absence of the out-of-bounds write and crash.

Typical attack path

1. Identify jq usage that accepts external or untrusted input
2. Craft a decimal literal such as []-1.2e-1111111111
3. Feed the input to jq via command-line arguments, stdin, or API
4. Trigger decToString during number conversion
5. Induce memory corruption leading to crash or instability

How to detect it

Search process logs and crash reports for jq invocations that terminate abnormally when the malformed decimal string appears in command arguments or stdin; inspect SIEM entries containing jq execution with numeric literals matching the pattern.

• []-1.2e-1111111111
• decToString
• decNumber.c

What your security team should do

• Inventory all uses of jq that process external data
• Apply the latest available jq release as soon as it is published
• Wrap jq invocations with input validation or sanitization until patched
• Monitor upstream jq repository for the corrective commit