← Vulnerability feed

Vulnerability record · CVE-2026-47770 · published 25 June 2026

CVE-2026-47770: Jqlang jq vulnerability

Jqlang · Jq

jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion (uncontrolled recursion). The crash occurs in jq's recursive structural comparison code, with the recursion repeating through jvp_array_equal() and jv_equal() in src/jv.c when comparing deeply nested arrays; a nearby sort comparator path through jv_cmp() in src/jv_aux.c overflows the stack at a larger nesting depth from the same missing recursion guard. Anyone running jq comparisons on attacker-controlled deeply nested JSON values, or embedding jq in a context where untrusted data can reach the == comparison path, is affected. This vulnerability is fixed in 1.8.2.

6.8 CVSS 4.0 Medium EPSS 0.16% · top 95.9% CWE-674 · CWE-674
6.8CVSS 4.0 base score
0.16%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References, 1 tagged exploit
26 Jun 2026Last modified by NVD

Description

jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion (uncontrolled recursion). The crash occurs in jq's recursive structural comparison code, with the recursion repeating through jvp_array_equal() and jv_equal() in src/jv.c when comparing deeply nested arrays; a nearby sort comparator path through jv_cmp() in src/jv_aux.c overflows the stack at a larger nesting depth from the same missing recursion guard. Anyone running jq comparisons on attacker-controlled deeply nested JSON values, or embedding jq in a context where untrusted data can reach the == comparison path, is affected. This vulnerability is fixed in 1.8.2.

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/jqlang/jq/security/advisories/GHSA-3pgx-frr7-3jxp ExploitMitigationVendor Advisory

Track CVE-2026-47770 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.1CVE-2024-53427Jqlang jq type confusion vulnerabilitydecNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buf…EPSS 0.36%7.7CVE-2025-48060Jqlang jq stack-based buffer overflow vulnerabilityjq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_…EPSS 0.53%7.5CVE-2026-32316Jqlang jq heap-based buffer overflow vulnerabilityjq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_cop…EPSS 0.49%7.5CVE-2023-49355Jqlang jq out-of-bounds write vulnerabilitydecToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" input. NOTE: this is not the same…EPSS 1.2%7.1CVE-2026-49839Jqlang jq out-of-bounds write vulnerabilityjq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-string error into invalid-state reuse and a real hea…EPSS 0.17%6.9CVE-2026-54679Jqlang jq integer overflow vulnerabilityjq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvp_string_append has a chance of integer/multiple overflowing and then causing…EPSS 0.15%6.9CVE-2026-39979Jqlang jq out-of-bounds read vulnerabilityjq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted …EPSS 0.82%6.5CVE-2024-23337Jqlang jq integer overflow vulnerabilityjq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483…EPSS 0.44%

Source: NIST National Vulnerability Database (record CVE-2026-47770), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.