# CVE-2026-40164: jqlang jq denial of service via predictable MurmurHash3 seed

Source: https://junglewise.ai/threats/cve-2026-40164-jqlang-jq-denial-of-service-via-predictable-murmurhash3-seed  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-14. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-40164 · Severity: high · CVSS 7.5 · Published 2026-04-14

jq is a widely used command-line tool for processing and transforming JSON data in automated environments like CI/CD pipelines and web services. A vulnerability in how it handles data allows an attacker to send a specially crafted, small JSON file that causes the tool to consume excessive CPU resources. This can lead to a denial-of-service condition, stalling automated workflows or crashing services that rely on jq to process external data.

Technologies: [Jqlang Jq](https://junglewise.ai/threats/technologies/jq). Vendors: [Jqlang](https://junglewise.ai/threats/vendors/jqlang).

## Quick answers

**Is CVE-2026-40164 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40164 being exploited in the wild.

**How severe is CVE-2026-40164?** High severity, with a CVSS score of 7.5, published 14 April 2026.

**Which products and versions are affected?** Jqlang Jq <= 1.8.1.

**Is there a fix for CVE-2026-40164?** A patch was published on 2026-05-12: Red Hat released security updates for RHEL 8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40164 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40164?** Check whether you run Jqlang Jq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an algorithmic complexity denial-of-service (DoS) rooted in the use of a hardcoded seed (0x432A9843) for the MurmurHash3 algorithm in src/jv.c. Because the seed is static and publicly known, an attacker can precompute a set of JSON keys that result in hash collisions. When jq processes a JSON object containing these keys, the internal hash table lookups degrade from constant time O(1) to linear time O(n), resulting in quadratic O(n²) overall complexity for jq expressions. This allows a relatively small payload (approx. 100KB) to cause significant CPU exhaustion. The issue is fixed in version 1.8.2 by randomizing the hash seed at process startup.

## Affected products

- jqlang jq <= 1.8.1
- Red Hat Red Hat Enterprise Linux 8 8.10
- Red Hat Red Hat OpenShift Container Platform 4.12, 4.13, 4.15

## Timeline

- 2026-04-13: advisory: GitHub Security Advisory GHSA-wwj8-gxm6-jc29 published
- 2026-04-14: disclosed: CVE-2026-40164 published
- 2026-05-12: patched: Red Hat released security updates for RHEL 8

## References

- [https://github.com/jqlang/jq/commit/0c7d133c3c7e37c00b6d46b658a02244fdd3c784](https://github.com/jqlang/jq/commit/0c7d133c3c7e37c00b6d46b658a02244fdd3c784)
- [https://github.com/jqlang/jq/security/advisories/GHSA-wwj8-gxm6-jc29](https://github.com/jqlang/jq/security/advisories/GHSA-wwj8-gxm6-jc29)
- [https://access.redhat.com/errata/RHSA-2026:16252](https://access.redhat.com/errata/RHSA-2026:16252)
- [https://access.redhat.com/errata/RHSA-2026:16692](https://access.redhat.com/errata/RHSA-2026:16692)
- [https://access.redhat.com/errata/RHSA-2026:16693](https://access.redhat.com/errata/RHSA-2026:16693)
- [https://access.redhat.com/errata/RHSA-2026:18040](https://access.redhat.com/errata/RHSA-2026:18040)
- [https://access.redhat.com/errata/RHSA-2026:18042](https://access.redhat.com/errata/RHSA-2026:18042)

## Related threats

- [jqlang jq integer overflow in jvp_string_append on 32-bit systems](https://junglewise.ai/threats/cve-2026-54679-jqlang-jq-integer-overflow-in-jvp-string-append-on-32-bit-systems)
- [jqlang jq heap out-of-bounds write in --rawfile processing](https://junglewise.ai/threats/cve-2026-49839-jqlang-jq-heap-out-of-bounds-write-in-rawfile-processing)
- [jqlang jq Denial of Service via Stack Exhaustion in Structural Comparison](https://junglewise.ai/threats/cve-2026-47770-jqlang-jq-denial-of-service-via-stack-exhaustion-in-structural)
- [jqlang jq uncontrolled recursion in module loader](https://junglewise.ai/threats/cve-2026-44777-jqlang-jq-uncontrolled-recursion-in-module-loader)
- [jqlang jq stack overflow in jv_object_merge_recursive](https://junglewise.ai/threats/cve-2026-43896-jqlang-jq-stack-overflow-in-jv-object-merge-recursive)