Executive brief
jq is a widely used command-line tool and library for processing JSON data. A vulnerability in how it handles deeply nested data structures can cause the application to crash or potentially corrupt memory. This could lead to a denial-of-service or, in specific embedded environments, allow an attacker to interfere with other running processes or data.
Technical details
The vulnerability is an uncontrolled recursion (CWE-674) within the jv_contains function in src/jv.c. While the standard JSON parser limits depth to 10,000, an attacker can programmatically construct more deeply nested structures using the 'reduce' function. When jq attempts to process these structures via the 'contains()' or 'inside()' functions, it exhausts the C stack. On standard Linux systems, this results in a SIGSEGV (Denial of Service); however, on systems without stack guard pages or where libjq is embedded in multi-threaded applications, this can lead to heap metadata corruption or adjacent thread stack overwrites. No patch was available at the time of the advisory.
Affected products
- jqlang jq <= 1.8.1
Timeline
- 2026-04-24: advisory: GitHub Security Advisory published
- 2026-05-11: disclosed: CVE-2026-40612 published to NVD