Circular Dependency Vulnerability in jq Command-Line JSON Processor

CVE-2026-44777

What is CVE-2026-44777?

In jq, a command-line JSON processor, a vulnerability exists due to the ordinary module loader's inability to detect cycles when two valid modules reference each other. Versions 1.8.2rc1 and earlier are affected, allowing unintended recursion which can lead to performance degradation and potential service disruptions. It is crucial for users of jq to monitor their installations and apply necessary patches or updates to mitigate the risk associated with this vulnerability.

References