CVE-2026-47770: jq: stack overflow in deep structural equality
jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion (uncontrolled recursion). The crash occurs in jq's recursive structural comparison code, with the recursion repeating through jvparrayequal() and jvequal() in src/jv.c when comparing deeply nested arrays; a nearby sort comparator path through jvcmp() in src/jvaux.c overflows the stack at a larger nesting depth from the same missing recursion guard. Anyone running jq comparisons on attacker-controlled deeply nested JSON values, or embedding jq in a context where untrusted data can reach the == comparison path, is affected. This vulnerability is fixed in 1.8.2.
Other sources
jq: stack overflow in deep structural equality
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.7.1-7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.7.1-8 - Upgrade
Upgrade
jqto a version that resolves this vulnerability.Fixed in 1.8.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47770?
CVE-2026-47770 has a medium severity rating of 6.8 on the CVSS scale.
How does CVE-2026-47770 affect jq?
CVE-2026-47770 can cause jq to experience a stack overflow when comparing deeply nested arrays, leading to denial of service.
What versions of jq are affected by CVE-2026-47770?
CVE-2026-47770 affects jq versions prior to 1.8.2.
How can I mitigate the risks associated with CVE-2026-47770?
To mitigate CVE-2026-47770, update jq to version 1.8.2 or later.
Is CVE-2026-47770 related to recursion issues in jq?
Yes, CVE-2026-47770 is caused by uncontrolled recursion leading to stack exhaustion during deep structural equality comparisons.