CVE-2026-40612 — jq: Stack overflow via unbounded recursion in jv_contains
jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects with no depth limit. With a sufficiently nested input structure (built…
Published: 2026-05-11 · CVSS: 5.4 · CVSS 4.0
jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since the JSON parser caps at depth 10000), the C stack is exhausted.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7