Executive brief
jq is a widely used command-line tool for processing and transforming JSON data. A vulnerability in how it compares data structures allows an attacker to crash the program by providing specially crafted, deeply nested JSON files. This results in a denial-of-service, potentially disrupting automated workflows or services that rely on jq to process external data.
Technical details
A stack exhaustion vulnerability exists in jq's structural comparison logic due to uncontrolled recursion. When comparing deeply nested JSON arrays using the '==' operator, the functions jvp_array_equal() and jv_equal() in src/jv.c recurse without sufficient depth guards. A similar issue exists in the sort comparator path through jv_cmp() in src/jv_aux.c. An attacker can trigger a crash (Denial of Service) by providing maliciously nested JSON data to jq. The vulnerability is local in nature but can be triggered remotely if jq is used to process untrusted input in a pipeline or service. The issue is fixed in version 1.8.2 by implementing recursion limits.
Affected products
- jqlang jq < 1.8.2
Timeline
- 2026-05-22: advisory: GitHub Security Advisory published
- 2026-06-25: disclosed: CVE published to NVD
- 2026-06-25: patched: Fixed in version 1.8.2