Junglewise Threat Intelligence

CVE-2026-40164: jqlang jq denial of service via predictable MurmurHash3 seed

CVE-2026-40164 · Severity: high · CVSS 7.5 · Published 2026-04-14

Technologies: Jqlang Jq, Red Hat OpenShift Container Platform, Red Hat Enterprise Linux 8. Vendors: Jqlang, Red Hat.

Executive brief

jq is a widely used command-line tool for processing and transforming JSON data in automated environments like CI/CD pipelines and web services. A vulnerability in how it handles data allows an attacker to send a specially crafted, small JSON file that causes the tool to consume excessive CPU resources. This can lead to a denial-of-service condition, stalling automated workflows or crashing services that rely on jq to process external data.

Technical details

The vulnerability is an algorithmic complexity denial-of-service (DoS) rooted in the use of a hardcoded seed (0x432A9843) for the MurmurHash3 algorithm in src/jv.c. Because the seed is static and publicly known, an attacker can precompute a set of JSON keys that result in hash collisions. When jq processes a JSON object containing these keys, the internal hash table lookups degrade from constant time O(1) to linear time O(n), resulting in quadratic O(n²) overall complexity for jq expressions. This allows a relatively small payload (approx. 100KB) to cause significant CPU exhaustion. The issue is fixed in version 1.8.2 by randomizing the hash seed at process startup.

Affected products

  • jqlang jq <= 1.8.1
  • Red Hat Red Hat Enterprise Linux 8 8.10
  • Red Hat Red Hat OpenShift Container Platform 4.12, 4.13, 4.15

Timeline

  • 2026-04-13: advisory: GitHub Security Advisory GHSA-wwj8-gxm6-jc29 published
  • 2026-04-14: disclosed: CVE-2026-40164 published
  • 2026-05-12: patched: Red Hat released security updates for RHEL 8

References

Related threats