CVE-2026-33947 Details

A denial-of-service vulnerability has been identified in jq, a command-line JSON processor, affecting versions through 1.8.1. The issue arises in the 'jv_setpath()', 'jv_getpath()', and 'delpaths_sorted()' functions within 'src/jv_aux.c', where unbounded recursion can occur. This recursion depth is determined by the length of a caller-supplied path array, with no limit enforced during runtime path operations. An attacker can exploit this by supplying a JSON document containing a flat array of approximately 65,000 integers, which, when processed by a trusted jq filter, exhausts the C call stack. This flaw causes the process to crash with a segmentation fault, bypassing the existing JSON parsing depth limit of 10,000. The vulnerability affects any application or service that uses jq to process untrusted JSON input through these built-in functions, leading to an unrecoverable crash.

Users can update to jq version 1.8.2 or later, where this vulnerability has been fixed. Instructions for updating can be found in the jq repository on GitHub.