Skip to main content

jq CVE-2026-33947

| EUVDEUVD-2026-22124 MEDIUM
Uncontrolled Recursion (CWE-674)
2026-04-13 GitHub_M
Denial Of Service Jq Jqlang
6.2
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
6.2 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
6.2 MEDIUM

Local attack vector reflects jq as a process receiving piped input; no privileges needed, no scope change, and impact is availability-only via unrecoverable crash.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
6.2 MEDIUM
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Source Code Evidence Fetched
Jul 24, 2026 - 07:49 vuln.today
Analysis Generated
Jul 24, 2026 - 07:49 vuln.today
Patch released
Apr 19, 2026 - 08:30 nvd
Patch available
EUVD ID Assigned
Apr 13, 2026 - 22:00 euvd
EUVD-2026-22124
CVE Published
Apr 13, 2026 - 21:50 nvd
MEDIUM 6.2

DescriptionGitHub Advisory

jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(), and delpaths_sorted() in jq's src/jv_aux.c use unbounded recursion whose depth is controlled by the length of a caller-supplied path array, with no depth limit enforced. An attacker can supply a JSON document containing a flat array of ~65,000 integers (~200 KB) that, when used as a path argument by a trusted jq filter, exhausts the C call stack and crashes the process with a segmentation fault (SIGSEGV). This bypass works because the existing MAX_PARSING_DEPTH (10,000) limit only protects the JSON parser, not runtime path operations where arrays can be programmatically constructed to arbitrary lengths. The impact is denial of service (unrecoverable crash) affecting any application or service that processes untrusted JSON input through jq's setpath, getpath, or delpaths builtins. This issue has been addressed in commit fb59f1491058d58bdc3e8dd28f1773d1ac690a1f.

AnalysisAI

Stack exhaustion denial of service in jq 1.8.1 and below allows an attacker who controls JSON input to a filter using setpath, getpath, or delpaths built-ins to crash the processing application with a SIGSEGV by supplying a flat array of approximately 65,000 integers (~200 KB) as a path argument. The unbounded recursion in jv_setpath(), jv_getpath(), and delpaths_sorted() (src/jv_aux.c) is limited only by the C call stack, not by any runtime depth guard - the existing MAX_PARSING_DEPTH (10,000) guard applies exclusively to the JSON parser and does not protect path operations. Publicly available exploit code exists per SSVC analysis; no active exploitation is confirmed in CISA KEV, and the EPSS score of 0.01% (2nd percentile) suggests limited current adversary interest.

Technical ContextAI

jq (CPE: cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:*) is a C-based command-line JSON processor widely embedded in DevOps pipelines, shell scripts, and server-side applications that parse or transform JSON data. The root cause is CWE-674 (Uncontrolled Recursion): the three path-traversal functions in src/jv_aux.c recurse once per element of the caller-supplied path array, with recursion depth bounded only by the available C stack (typically 1-8 MB). The critical gap is architectural: the existing MAX_PARSING_DEPTH macro (10,000) was defined to protect the JSON parser against deeply nested documents, but was never applied to runtime path operations, where arrays can be constructed programmatically to arbitrary length - bypassing the protection entirely. The fix (commit fb59f1491058d58bdc3e8dd28f1773d1ac690a1f) introduces a separate MAX_PATH_DEPTH (10,000) guard at the entry of all three functions, returning a jv_invalid error rather than recursing.

RemediationAI

The upstream fix is available in commit fb59f1491058d58bdc3e8dd28f1773d1ac690a1f (https://github.com/jqlang/jq/commit/fb59f1491058d58bdc3e8dd28f1773d1ac690a1f); a specific patched release version (e.g., 1.8.2) is not independently confirmed from available input data - users should track the jq release page and the GitHub advisory (https://github.com/jqlang/jq/security/advisories/GHSA-xwrw-4f8h-rjvg) for tagged releases incorporating this commit. Ubuntu users should apply the update described in USN-8202-1 (https://ubuntu.com/security/notices/USN-8202-1). As a compensating control where patching is not immediately possible, restrict or audit jq filter definitions used in services processing untrusted input to remove or wrap calls to setpath, getpath, and delpaths; filters that do not invoke these three built-ins are not affected by this vulnerability. Additionally, enforce input size limits upstream (e.g., reject JSON payloads exceeding a defined byte threshold) to reduce the likelihood of a ~200 KB path-array payload reaching jq - note that size limits alone are an imperfect mitigation because a sufficiently compact encoding could still trigger the recursion.

More in Jq

View all
CVE-2024-53427 HIGH POC
8.1 Feb 26

decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which ha
CVE-2015-8863 CRITICAL
9.8 May 06

Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (cras
CVE-2025-48060 HIGH POC
7.7 May 21

jq is a command-line JSON processor. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no auth
CVE-2016-4074 HIGH POC
7.5 May 06

The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and applicat
CVE-2023-49355 HIGH POC
7.5 Dec 11

decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" inpu
CVE-2023-50268 MEDIUM POC
5.5 Dec 13

jq is a command-line JSON processor. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Publ
CVE-2023-50246 MEDIUM POC
5.5 Dec 13

jq is a command-line JSON processor. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Publ
CVE-2026-32316 HIGH
8.2 Apr 13

Heap buffer overflow in jq command-line JSON processor (all versions through 1.8.1) allows remote unauthenticated attack
CVE-2026-49839 HIGH
7.1

Out-of-bounds write in the jq command-line JSON processor (CWE-787) lets a crafted JSON input corrupt memory when parsed
CVE-2026-54679 MEDIUM
6.9

jq, the command-line JSON processor, was patched in Alpine Linux with package version 1.8.2-r0. The specific vulnerabili
CVE-2026-39979 MEDIUM
6.9 Apr 13

Out-of-bounds read in libjq's jv_parse_sized() API exposes any embedding application to memory disclosure or process ter
CVE-2026-47770 MEDIUM
6.8

jq on Alpine Linux was patched in package version 1.8.2-r0, addressing an unspecified vulnerability. The nature of the f

Same weakness CWE-674 – Uncontrolled Recursion

View all
CVE-2019-9545 HIGH POC
8.8
CVE-2019-9543 HIGH POC
8.8
CVE-2019-9144 HIGH POC
8.8
CVE-2019-9143 HIGH POC
8.8
CVE-2026-9769 HIGH POC
8.7
CVE-2026-40345 HIGH POC
8.2
CVE-2025-9624 HIGH POC
8.3
CVE-2019-9192 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed
SLES15-SP6-CHOST-BYOS-Azure Fixed
SLES15-SP6-CHOST-BYOS-EC2 Fixed

Share

CVE-2026-33947 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy