jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects.
Metrics
Affected Vendors & Products
References
History
Wed, 13 May 2026 22:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:jqlang:jq:*:*:*:*:*:*:*:* |
Mon, 11 May 2026 20:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Jqlang
Jqlang jq |
|
| Vendors & Products |
Jqlang
Jqlang jq |
Mon, 11 May 2026 18:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects. | |
| Title | jq: Stack Overflow in Recursive Object Merge | |
| Weaknesses | CWE-674 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-05-12T16:15:17.281Z
Reserved: 2026-05-04T15:17:09.331Z
Link: CVE-2026-43896
Vulnrichment
No data.
NVD
Status : Analyzed
Published: 2026-05-11T18:16:37.530
Modified: 2026-05-13T22:34:34.033
Link: CVE-2026-43896
Redhat
No data.