CVE-2015-8863: Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of...

Security readout for executives and security teams

CVE-2015-8863 is a jq parser crash risk. A specially long JSON number can trigger a heap buffer overflow and cause denial of service. Business urgency depends on whether jq processes untrusted JSON in automation, APIs, data pipelines, or security tooling. Exposure is most likely where jq is installed on Linux systems or containers and parses attacker-controlled JSON. The bundle does not enumerate affected jq versions, so teams should map installed packages against vendor advisories and the upstream commit. Treat as a targeted availability risk, not a broad compromise signal based on current evidence. Prioritize patching systems where jq handles external or semi-trusted JSON, especially automation supporting production or security operations. Mitigation focus: Inventory jq on servers, containers, CI runners, and data-processing hosts.; Apply jq updates from affected Linux distribution advisories.; Check upstream jq commit 8eb1367 for fixed parser behavior..

Prepared

Jun 13, 2026, 14:44 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.