The jq command-line JSON processor has a vulnerability (CVE-2026-47770) involving uncontrolled recursion in its recursive structural comparison code. When comparing two sufficiently deeply nested arrays with the == operator, the recursion through functions jvp_array_equal() and jv_equal() in src/jv.c causes stack exhaustion and a crash. A related recursion path through jv_cmp() in src/jv_aux.c also leads to stack overflow at higher nesting depths. This vulnerability can be triggered by processing attacker-controlled deeply nested JSON data or embedding jq where untrusted data reaches the comparison path. The issue is resolved in jq version 1.8.2.

Exploitation of this vulnerability results in denial of service due to stack exhaustion and crash of the jq process. This can disrupt workflows or services relying on jq for JSON processing when handling deeply nested arrays, especially if the input is attacker-controlled. There is no indication of code execution or data corruption beyond denial of service.

Upgrade jq to version 1.8.2 or later, where this uncontrolled recursion vulnerability has been fixed. Until upgrading, avoid processing untrusted deeply nested JSON arrays with the == operator in jq. Patch status is confirmed fixed in 1.8.2.