The vulnerability in jq involves the use of a weak hash function configuration: MurmurHash3 with a fixed, publicly visible seed (0x432A9843) for hashing JSON object keys. Attackers can precompute key collisions offline and supply a crafted JSON object (~100 KB) where all keys hash to the same bucket. This causes hash table lookups to degrade from constant time to linear time, turning jq expression evaluation into a quadratic time operation, leading to high CPU usage and potential denial of service. The vulnerability affects jq versions before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784 and has been fixed in that commit.

Exploitation of this vulnerability causes significant CPU exhaustion due to degraded hash table performance, potentially leading to denial of service in environments using vulnerable jq versions. This affects workflows such as CI/CD pipelines, web services, and data processing scripts that rely on jq for JSON processing. There is no impact on confidentiality or integrity, only availability due to resource exhaustion. No known exploits in the wild have been reported.

This vulnerability has been patched in jq as of commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784. Users should upgrade to this commit or later versions to remediate the issue. Since jq is not a cloud service, remediation requires updating the software in affected environments. Patch status is confirmed by the vendor commit; no additional temporary fixes are indicated.