CVE-2026-47770: CWE-674: Uncontrolled Recursion in jqlang jq
jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion (uncontrolled recursion). The crash occurs in jq's recursive structural comparison code, with the recursion repeating through jvp_array_equal() and jv_equal() in src/jv.c when comparing deeply nested arrays; a nearby sort comparator path through jv_cmp() in src/jv_aux.c overflows the stack at a larger nesting depth from the same missing recursion guard. Anyone running jq comparisons on attacker-controlled deeply nested JSON values, or embedding jq in a context where untrusted data can reach the == comparison path, is affected. This vulnerability is fixed in 1.8.2.
AI Analysis
Technical Summary
CVE-2026-47770 describes an uncontrolled recursion vulnerability in jq, a command-line JSON processor. When comparing two sufficiently deeply nested arrays using the == operator in versions prior to 1.8.2, jq's recursive comparison functions (jvp_array_equal() and jv_equal()) exhaust the C stack, causing a denial of service. A related recursion path through jv_cmp() can also overflow the stack at higher nesting depths. This vulnerability affects any use of jq that compares attacker-controlled deeply nested JSON arrays or embeds jq where untrusted data reaches the comparison path. The vulnerability is resolved in jq version 1.8.2.
Potential Impact
The vulnerability allows denial of service via stack exhaustion when jq compares deeply nested arrays. This can crash jq processes or applications embedding jq, potentially disrupting services that rely on JSON processing with untrusted input. There is no indication of code execution or data corruption beyond denial of service.
Mitigation Recommendations
This vulnerability is fixed in jq version 1.8.2. Users should upgrade to version 1.8.2 or later to remediate this issue. No official patch or temporary fix is indicated beyond upgrading. Until upgraded, avoid processing untrusted deeply nested JSON arrays with the == operator in jq.
CVE-2026-47770: CWE-674: Uncontrolled Recursion in jqlang jq
Description
jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion (uncontrolled recursion). The crash occurs in jq's recursive structural comparison code, with the recursion repeating through jvp_array_equal() and jv_equal() in src/jv.c when comparing deeply nested arrays; a nearby sort comparator path through jv_cmp() in src/jv_aux.c overflows the stack at a larger nesting depth from the same missing recursion guard. Anyone running jq comparisons on attacker-controlled deeply nested JSON values, or embedding jq in a context where untrusted data can reach the == comparison path, is affected. This vulnerability is fixed in 1.8.2.
CVSS v4.0
Score 6.8medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-47770 describes an uncontrolled recursion vulnerability in jq, a command-line JSON processor. When comparing two sufficiently deeply nested arrays using the == operator in versions prior to 1.8.2, jq's recursive comparison functions (jvp_array_equal() and jv_equal()) exhaust the C stack, causing a denial of service. A related recursion path through jv_cmp() can also overflow the stack at higher nesting depths. This vulnerability affects any use of jq that compares attacker-controlled deeply nested JSON arrays or embeds jq where untrusted data reaches the comparison path. The vulnerability is resolved in jq version 1.8.2.
Potential Impact
The vulnerability allows denial of service via stack exhaustion when jq compares deeply nested arrays. This can crash jq processes or applications embedding jq, potentially disrupting services that rely on JSON processing with untrusted input. There is no indication of code execution or data corruption beyond denial of service.
Mitigation Recommendations
This vulnerability is fixed in jq version 1.8.2. Users should upgrade to version 1.8.2 or later to remediate this issue. No official patch or temporary fix is indicated beyond upgrading. Until upgraded, avoid processing untrusted deeply nested JSON arrays with the == operator in jq.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-19T22:36:16.882Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3d65db4853345fc13feb03
Added to database: 06/25/2026, 17:31:07 UTC
Last enriched: 07/02/2026, 22:35:30 UTC
Last updated: 08/09/2026, 00:41:15 UTC
Views: 89
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.