CVE-2026-47770: jq Stack Exhaustion DoS via Deeply Nested Array Comparison

Technical summary

The vulnerability stems from uncontrolled recursion in jq's structural comparison functions, specifically jvp_array_equal() and jv_equal() in src/jv.c. When the == operator is used to compare arrays with sufficient nesting depth, these functions recurse without a depth guard, eventually exhausting the C stack and crashing the process. A secondary code path through jv_cmp() in src/jv_aux.c used by sort operations exhibits the same flaw at larger nesting depths. The missing recursion depth limit allows an attacker to craft a JSON payload with arbitrarily deep array nesting to reliably trigger stack overflow. Versions 1.8.2 and later include recursion guards to prevent this condition.

Business impact

For organizations using jq in automated pipelines, data processing workflows, or as an embedded component, this vulnerability can cause unexpected service interruptions. If jq is invoked on user-supplied or external JSON data without input validation, an attacker can send a malicious JSON payload to crash the process. This impacts availability but not confidentiality or integrity. The severity is moderate because the attack requires either local access or the ability to influence input data reaching jq's comparison logic, and does not grant elevated privileges or data exfiltration.

Affected systems

jqlang jq versions prior to 1.8.2 are affected. This includes jq embedded in applications, used in shell scripts and automation, and deployed in data pipelines. Any system or service that processes JSON data with jq and accepts untrusted or adversarial input is at risk. This spans development environments, CI/CD systems, data processing clusters, and standalone command-line usage where jq processes external JSON sources.

Exploitability

Exploitability is straightforward but requires user interaction or control over input data. An attacker must either (1) trick a user into running jq on a malicious JSON file, or (2) place malicious JSON in a data stream processed by a jq-dependent service. The attack does not require special privileges, network access, or complex techniques—a single deeply nested JSON array is sufficient. The CVSS score of 5.5 reflects the local/user-interaction requirement and the availability-only impact.

Remediation

Upgrade jq to version 1.8.2 or later. Verify the upgrade by checking jq --version. For systems where immediate upgrade is not feasible, restrict jq's input to trusted, validated JSON sources and implement input size or nesting depth limits upstream of jq. However, patching is the definitive fix and should be prioritized.

Patch guidance

Patch jq to version 1.8.2 or later. Download from the official jqlang jq repository or your distribution's package manager (apt, brew, yum, etc.). After patching, verify the version: `jq --version` should report 1.8.2 or higher. For embedded jq libraries, update the jq library dependency in your build configuration and rebuild your application. Test your workflows to ensure compatibility with the patched version before full deployment.

Detection guidance

Monitor for jq process crashes or high CPU/memory usage during JSON processing. Log and alert on jq exit codes indicating segmentation faults (exit code 139 on Linux/Unix). Review logs for unexpected termination of jq processes, particularly in automated pipelines. If feasible, add logging around jq invocations to capture input size and nesting depth metrics. Intrusion detection systems should flag attempts to process exceptionally deeply nested JSON structures through jq, though this requires visibility into application data flows.

Why prioritize this

This vulnerability merits prompt patching because jq is commonly embedded in DevOps toolchains, CI/CD pipelines, and data processing workflows. A malicious JSON payload can reliably disrupt service availability. While not in the CISA KEV catalog, the ease of exploitation and prevalence of jq in automation make it a solid medium priority. Organizations using jq on untrusted input should patch within the standard vulnerability window (30–60 days). Lower priority for environments where jq only processes internal, curated data.

Risk score, explained

CVSS 5.5 (Medium) reflects moderate risk: uncontrolled recursion causes denial of service (high impact on availability), but exploitation requires local access or control over input, and the attack surface is limited to systems actively processing untrusted JSON with jq. There is no privilege escalation, data leakage, or system compromise, only temporary service unavailability. The score correctly aligns with typical medium-severity availability issues.

Frequently asked questions