Command-Line JSON Processor Vulnerability in jq by JqLang

CVE-2026-33947

What is CVE-2026-33947?

The jq command-line JSON processor has a vulnerability in versions 1.8.1 and earlier where unbounded recursion occurs within key functions. This weakness can be exploited by supplying a JSON document with a large array, resulting in a stack overflow that crashes the application processing untrusted input. While there's a limit for parsing depth, this does not extend to runtime path operations, allowing programmatically constructed arrays to exceed safe limits. The vulnerability poses a significant risk to any service handling JSON through jq due to potential service disruption.

References