CVE-2026-47770: jq: stack overflow in deep structural equality

Vulnerability summary

CVE-2026-47770 is a medium (CVSS 6.8) Uncontrolled Recursion vulnerability in jqlang jq. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 3.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 25-06-2026
   PublishedVulnerability first disclosed.
2. 26-06-2026
   Last modifiedVulnerability information updated.

Description

jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion (uncontrolled recursion). The crash occurs in jq's recursive structural comparison code, with the recursion repeating through jvp_array_equal() and jv_equal() in src/jv.c when comparing deeply nested arrays; a nearby sort comparator path through jv_cmp() in src/jv_aux.c overflows the stack at a larger nesting depth from the same missing recursion guard. Anyone running jq comparisons on attacker-controlled deeply nested JSON values, or embedding jq in a context where untrusted data can reach the == comparison path, is affected. This vulnerability is fixed in 1.8.2.

• CWE-674Uncontrolled RecursionThe product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.