jq CVE-2026-41257

Upgrade jq to version 1.8.2 or later as soon as it becomes available from the jqlang project (https://github.com/jqlang/jq). Until a patched release is available, restrict execution of jq on untrusted JSON inputs by implementing input validation that rejects excessively nested structures (configure depth limits in jq filters using recursion depth guards or input pre-processing) and running jq in a restricted sandbox environment (e.g., containers with read-only filesystems, reduced memory limits via cgroups to prevent 1 GiB allocations) if processing partially-trusted data is unavoidable. Limit filesystem access to jq processes via SELinux or AppArmor policies. Monitor jq process memory consumption for anomalies. Note that these controls reduce but do not eliminate risk if the attacker controls the jq filter expression itself.