JSON Processor Vulnerability in jq by JQLang

CVE-2026-40164

What is CVE-2026-40164?

A vulnerability in jq, a command-line JSON processor, allows an attacker to exploit key collisions through a hardcoded seed in its hashing function. Prior to a specific commit, jq's hashing mechanism utilized MurmurHash3 with a publicly visible seed, enabling attackers to craft JSON objects that would consistently hash to the same bucket. This could lead to hash table lookups degrading significantly, resulting in performance impacts that could exhaust CPU resources during typical use cases such as CI/CD pipelines and data processing scripts. The issue has since been addressed in commit 0c7d133 of the jq repository.

References