Is CVE-2026-33947 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33947 being exploited in the wild.

How severe is CVE-2026-33947?

Medium severity, with a CVSS score of 6.2, published 13 April 2026.

Is there a fix for CVE-2026-33947?

A patch was published on 2026-04-13: Fixed in commit fb59f1491058d58bdc3e8dd28f1773d1ac690a1f Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33947 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-33947?

Check whether you run Jqlang Jq. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33947: jqlang jq uncontrolled recursion in path functions

CVE-2026-33947 · Severity: medium · CVSS 6.2 · Published 2026-04-13

jq is a widely used command-line tool and library for processing and transforming JSON data. A vulnerability in how it handles data paths allows an attacker to provide a specially crafted JSON file that causes the program to crash immediately. This can be used to disrupt services, web applications, or automated pipelines that rely on jq to process user-supplied information.

Technologies: Jqlang Jq. Vendors: Jqlang.

Quick answers

Is CVE-2026-33947 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33947 being exploited in the wild.
How severe is CVE-2026-33947?: Medium severity, with a CVSS score of 6.2, published 13 April 2026.
Which products and versions are affected?: jqlang jq <= 1.8.1.
Is there a fix for CVE-2026-33947?: A patch was published on 2026-04-13: Fixed in commit fb59f1491058d58bdc3e8dd28f1773d1ac690a1f Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33947 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-33947?: Check whether you run Jqlang Jq. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The jv_setpath(), jv_getpath(), and delpaths_sorted() functions in src/jv_aux.c use unbounded recursion where the depth is determined by the length of a caller-supplied path array. While jq has a MAX_PARSING_DEPTH to protect the initial JSON parsing stage, these runtime functions lacked similar enforcement. An attacker can bypass parser limits by providing a flat array (e.g., ~65,000 integers) that, when used as a path argument in a jq filter, exhausts the C call stack and triggers a segmentation fault (SIGSEGV). This affects both the jq CLI and applications embedding libjq. The issue is fixed in commit fb59f149 by introducing a MAX_PATH_DEPTH limit of 10,000.

Affected products

jqlang jq <= 1.8.1

Timeline

2026-04-13: advisory: GitHub Security Advisory GHSA-xwrw-4f8h-rjvg published
2026-04-13: disclosed
2026-04-13: patched: Fixed in commit fb59f1491058d58bdc3e8dd28f1773d1ac690a1f

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.