The vulnerability in jq (<= 1.8.1) involves the jv_contains function, which performs recursive checks into nested JSON arrays or objects without limiting recursion depth. Because jq's JSON parser limits input depth to 10,000, this issue arises only with programmatically constructed nested structures using reduce. The uncontrolled recursion can exhaust the C stack, potentially causing a denial of service due to application crash. The CVSS 4.0 base score is 5.4, reflecting a medium severity with local attack vector and no privileges required but user interaction necessary.

Exploitation of this vulnerability can cause jq to crash by exhausting the C stack when processing deeply nested JSON structures. This results in a denial of service condition. There is no indication of code execution or data corruption beyond service interruption. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing JSON inputs with extremely deep nesting created programmatically. Monitor jq releases for updates addressing this issue.