jqlang jq up to 1.8.1 src/jv_aux.c jv_setpath/jv_getpath/delpaths_sorted path recursion

Summaryinfo

A vulnerability identified as problematic has been detected in jqlang jq up to 1.8.1. This affects the function jv_setpath/jv_getpath/delpaths_sorted of the file src/jv_aux.c. The manipulation of the argument path leads to recursion. This vulnerability is listed as CVE-2026-33947. The attack must be carried out locally. There is no available exploit. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in jqlang jq up to 1.8.1 and classified as problematic. This issue affects the function jv_setpath/jv_getpath/delpaths_sorted of the file src/jv_aux.c. The manipulation of the argument path with an unknown input leads to a recursion vulnerability. Using CWE to declare the problem leads to CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. Impacted is availability. The summary by CVE is:

jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(), and delpaths_sorted() in jq's src/jv_aux.c use unbounded recursion whose depth is controlled by the length of a caller-supplied path array, with no depth limit enforced. An attacker can supply a JSON document containing a flat array of ~65,000 integers (~200 KB) that, when used as a path argument by a trusted jq filter, exhausts the C call stack and crashes the process with a segmentation fault (SIGSEGV). This bypass works because the existing MAX_PARSING_DEPTH (10,000) limit only protects the JSON parser, not runtime path operations where arrays can be programmatically constructed to arbitrary lengths. The impact is denial of service (unrecoverable crash) affecting any application or service that processes untrusted JSON input through jq's setpath, getpath, or delpaths builtins. This issue has been addressed in commit fb59f1491058d58bdc3e8dd28f1773d1ac690a1f.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-33947 since 03/24/2026. The exploitation is known to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 307501 (Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2026-33947)), which helps to determine the existence of the flaw in a target environment.

Applying the patch fb59f1491058d58bdc3e8dd28f1773d1ac690a1f is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at Tenable (307501). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• jqlang

Name

• jq

Version

• 1.8.0
• 1.8.1

License

• open-source

Website

• Product: https://github.com/jqlang/jq/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion