jq versions 1.8.1 and earlier have an uncontrolled recursion vulnerability (CWE-674) in the jv_object_merge_recursive() function. This function is reachable when using the * operator on two JSON objects. The flaw allows crafted jq programs to trigger unbounded recursion, leading to a segmentation fault and process crash. The CVSS 3.1 base score is 6.2 (medium), reflecting local attack vector, low complexity, no privileges required, no user interaction, and impact limited to availability. There is no vendor advisory or patch currently available, and the vulnerability is not related to cloud services.

The vulnerability causes a denial of service by crashing the jq process through a segmentation fault triggered by unbounded recursion. There is no impact on confidentiality or integrity. The attack requires local access to run a crafted jq program. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted JSON inputs with jq versions 1.8.1 and earlier, especially when using the * operator on objects. Monitor jq project communications for updates or patches addressing this issue.