Stack Exhaustion Vulnerability in jq Command-Line JSON Processor by JQLang

CVE-2026-40612

What is CVE-2026-40612?

The jq command-line JSON processor, specifically versions 1.8.1 and earlier, contains a vulnerability in its jv_contains function that allows for unbounded recursion into nested arrays or objects. This lack of a depth limit potentially leads to stack exhaustion when handling deeply nested structures, which can be crafted programmatically beyond the JSON parser's depth cap. As a result, this vulnerability presents a risk of denial of service, impacting the functionality of jq when processing complex JSON inputs.

References