CVE-2026-40164: CWE-328: Use of Weak Hash in jqlang jq
jq versions prior to commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784 used MurmurHash3 with a hardcoded, publicly known seed for JSON object hashing. This allowed attackers to craft JSON objects that cause all keys to collide in the same hash bucket, degrading performance from O(1) to O(n) and turning jq operations into O(n²), resulting in significant CPU exhaustion. This vulnerability affects jq use in CI/CD pipelines, web services, and data processing scripts. The issue has been patched in the specified commit.
AI Analysis
Technical Summary
The jq JSON processor used a weak hash implementation (MurmurHash3 with a fixed seed) for JSON object hash tables, enabling attackers to precompute key collisions offline. By submitting a crafted JSON object (~100 KB) with colliding keys, attackers can cause hash table lookups to degrade from constant time to linear time, causing jq expressions to run in quadratic time and exhaust CPU resources. This vulnerability impacts jq versions before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784 and has been fixed in that commit.
Potential Impact
Exploitation leads to significant CPU exhaustion due to degraded hash table performance, impacting availability and performance of jq in automated pipelines, web services, and data processing. There is no confidentiality or integrity impact reported. The CVSS score is 7.5 (high severity) reflecting network attack vector, low complexity, no privileges required, no user interaction, and impact on availability only.
Mitigation Recommendations
A fix is available and has been applied in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784. Users should upgrade jq to this commit or later to remediate the vulnerability. No other mitigation is indicated or required.
CVE-2026-40164: CWE-328: Use of Weak Hash in jqlang jq
Description
jq versions prior to commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784 used MurmurHash3 with a hardcoded, publicly known seed for JSON object hashing. This allowed attackers to craft JSON objects that cause all keys to collide in the same hash bucket, degrading performance from O(1) to O(n) and turning jq operations into O(n²), resulting in significant CPU exhaustion. This vulnerability affects jq use in CI/CD pipelines, web services, and data processing scripts. The issue has been patched in the specified commit.
CVSS v3.1
Score 7.5high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The jq JSON processor used a weak hash implementation (MurmurHash3 with a fixed seed) for JSON object hash tables, enabling attackers to precompute key collisions offline. By submitting a crafted JSON object (~100 KB) with colliding keys, attackers can cause hash table lookups to degrade from constant time to linear time, causing jq expressions to run in quadratic time and exhaust CPU resources. This vulnerability impacts jq versions before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784 and has been fixed in that commit.
Potential Impact
Exploitation leads to significant CPU exhaustion due to degraded hash table performance, impacting availability and performance of jq in automated pipelines, web services, and data processing. There is no confidentiality or integrity impact reported. The CVSS score is 7.5 (high severity) reflecting network attack vector, low complexity, no privileges required, no user interaction, and impact on availability only.
Mitigation Recommendations
A fix is available and has been applied in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784. Users should upgrade jq to this commit or later to remediate the vulnerability. No other mitigation is indicated or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-09T19:31:56.014Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69dd83f182d89c981f8ff25a
Added to database: 4/14/2026, 12:01:53 AM
Last enriched: 4/21/2026, 6:09:50 AM
Last updated: 5/29/2026, 12:24:47 PM
Views: 98
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.