CVE-2026-47770

jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion (uncontrolled recursion). The crash occurs in jq's recursive structural comparison code, with the recursion repeating through jvp_array_equal() and jv_equal() in src/jv.c when comparing deeply nested arrays; a nearby sort comparator path through jv_cmp() in src/jv_aux.c overflows the stack at a larger nesting depth from the same missing recursion guard. Anyone running jq comparisons on attacker-controlled deeply nested JSON values, or embedding jq in a context where untrusted data can reach the == comparison path, is affected. This vulnerability is fixed in 1.8.2.

• CWE-674

• https://github.com/jqlang/jq/security/advisories/GHSA-3pgx-frr7-3jxpExploit, Mitigation, Vendor Advisory

Published

Jun 25, 2026

Last Modified

Jun 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47764pdm is a Python package and dependency manager supporting th…8.4
• CVE-2026-47765Frappe is a full-stack web application framework. Prior to 1…7.1
• CVE-2026-47767Symfony is a PHP framework for web and console applications …9.8
• CVE-2026-47768nebula-mesh is a self-hosted control plane for Slack Nebula …5.5
• CVE-2026-47769APIFold reads an OpenAPI 3.x or Swagger 2.x specification an…5.3
• CVE-2026-4777A security flaw has been discovered in SourceCodester Sales …6.5
• CVE-2026-47774Envoy is an open source edge and service proxy designed for …7.5
• CVE-2026-47775Envoy is an open source edge and service proxy designed for …6.8
• CVE-2026-47777Mastodon is a free, open-source social network server based …7.5
• CVE-2026-47778Envoy is an open source edge and service proxy designed for …4.4
• CVE-2026-4778A weakness has been identified in SourceCodester Sales and I…6.5
• CVE-2026-47781PDM is a Python package and dependency manager. In versions …8.4