Denial of Service in jq Command-Line JSON Processor by Vulnerable Versions

CVE-2026-47770

What is CVE-2026-47770?

The jq command-line JSON processor is vulnerable to a denial of service that arises from a flaw in its recursive structural comparison mechanism. Versions prior to 1.8.2 can experience C stack exhaustion when comparing two deeply nested arrays using the == operator. This condition results in the software crashing as recursion exceeds the stack limit during the comparison process. Users who handle attacker-controlled deeply nested JSON values or incorporate jq in environments where untrusted data can trigger the comparison path are particularly susceptible. The issue has been rectified in version 1.8.2.

References