jq is a command-line JSON processor. In versions 1.8.1 and earlier, the jv_contains function recursively traverses nested arrays and objects without limiting recursion depth. When presented with a deeply nested JSON structure (beyond the parser's 10,000 depth limit, achievable via programmatic construction), this uncontrolled recursion exhausts the C stack, leading to a crash or denial of service. The CVSS 4.0 base score is 5.4 (medium severity), reflecting local attack vector, low complexity, no privileges required, user interaction needed, and high impact on availability.

An attacker who can supply or influence the input JSON to jq can cause the application to crash by exhausting the C stack through deeply nested structures. This results in denial of service but does not indicate code execution or data disclosure. The impact is limited to availability degradation of jq when processing maliciously crafted JSON inputs.

Patch status is not yet confirmed — no official fix or patch is currently available as per the vendor advisory. Users should monitor the vendor's announcements for updates. Until a fix is released, avoid processing untrusted or programmatically deeply nested JSON inputs with jq versions 1.8.1 or earlier to mitigate risk.