CVE-2026-43896: jq: Stack Overflow in Recursive Object Merge
jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43896?
CVE-2026-43896 is classified as a critical vulnerability due to the potential for unbounded recursion leading to a stack overflow.
How do I fix CVE-2026-43896?
To fix CVE-2026-43896, upgrade jq to version 1.8.2 or later, which addresses the unbounded recursion issue.
What versions of jq are affected by CVE-2026-43896?
CVE-2026-43896 affects jq versions 1.8.1 and earlier.
What kind of vulnerability is CVE-2026-43896?
CVE-2026-43896 is a stack overflow vulnerability that occurs in the recursive object merge function of jq.
How can CVE-2026-43896 be exploited?
CVE-2026-43896 can be exploited by executing a crafted jq program that triggers unbounded recursion, causing a segmentation fault.