CVE-2025-49014: jq heap use after free vulnerability in f_strflocaltime
jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function fstrflocaltime of /src/builtin.c. This issue has been patched in commit 499c91b, no known fix version exists at time of publication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jqto a version that resolves this vulnerability.Patch 499c91b
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49014?
CVE-2025-49014 is classified as a high severity vulnerability due to the heap use after free issue in jq version 1.8.0.
How do I fix CVE-2025-49014?
There is currently no known fixed version for CVE-2025-49014; however, upgrading to the patched version after commit 499c91b is recommended.
What software is affected by CVE-2025-49014?
CVE-2025-49014 affects jq version 1.8.0, which is a command-line JSON processor.
What type of vulnerability is CVE-2025-49014?
CVE-2025-49014 is a heap use after free vulnerability found within the function f_strflocaltime in jq.
When was CVE-2025-49014 disclosed?
CVE-2025-49014 was disclosed at the time of publication without a specified fix version.