CVE-2026-40612: jq: Stack overflow via unbounded recursion in jv_contains
jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since the JSON parser caps at depth 10000), the C stack is exhausted.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40612?
CVE-2026-40612 is classified as a high-severity vulnerability due to the potential for stack overflow and denial of service.
How do I fix CVE-2026-40612?
To mitigate CVE-2026-40612, upgrade to jq version 1.8.2 or later where the unbounded recursion has been addressed.
What causes the vulnerability in CVE-2026-40612?
CVE-2026-40612 is caused by unbounded recursion in the jv_contains function when processing deeply nested JSON structures.
Who is affected by CVE-2026-40612?
CVE-2026-40612 affects users of jq versions 1.8.1 and earlier, which may expose them to a stack overflow issue.
What is jq in relation to CVE-2026-40612?
jq is a command-line JSON processor that is vulnerable to stack overflow issues in processing deeply nested JSON structures as described in CVE-2026-40612.