Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a fixed, publicly known seed (0x432A9843) for all JSON object hash table operations. This allowed attackers to precompute key collisions offline and supply crafted JSON objects (~100 KB) where all keys hash to the same bucket. Consequently, hash table lookups degrade from constant time O(1) to linear time O(n), causing jq expressions to exhibit quadratic O(n²) time complexity and significant CPU exhaustion. This vulnerability affects typical jq usage scenarios including CI/CD pipelines, web services, and data processing scripts. The vulnerability has been patched in the specified commit. Red Hat has published multiple advisories referencing this CVE and providing security updates for affected products including OpenShift Container Platform 4.12.

An attacker can cause denial of service by supplying a crafted JSON object that triggers hash collisions in jq's hash table implementation, leading to significant CPU exhaustion due to degraded performance from O(1) to O(n) hash lookups and O(n²) overall operation complexity. This impacts availability but does not affect confidentiality or integrity. The vulnerability is rated high severity with a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

A patch fixing this vulnerability is available in jq as of commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784. Users should update jq to a version including this commit. Red Hat has released security advisories and updates addressing this issue for their affected products, including OpenShift Container Platform 4.12. Users of Red Hat products should apply these updates promptly. Patch status is confirmed by vendor advisories. No additional mitigations are specified.