Executive brief
jq is a widely used command-line tool for processing and transforming JSON data. A vulnerability in how it handles external modules allows an attacker to cause the program to crash by providing modules that reference each other in a loop. This results in a denial-of-service, potentially disrupting automated data processing pipelines or scripts that rely on jq.
Technical details
An uncontrolled recursion vulnerability (CWE-674) exists in jq's module loader. The issue occurs because the loader lacks cycle detection when resolving dependencies via the 'include' directive. If two modules mutually include each other, the loader repeatedly re-enters the resolution path (specifically through jq_realpath, find_lib, and load_library), leading to stack exhaustion and a process crash. An attacker can trigger this by influencing the module search path or providing malicious jq programs. As of the advisory date, no official patch is listed, though a fix involving tracking active resolutions in a stack is proposed.
Affected products
- jqlang jq 1.8.2rc1 and earlier
Timeline
- 2026-05-11: disclosed
- 2026-05-11: advisory