CVE-2026-43896
jq is a command-line JSON processor.
Published May 11, 2026 · updated Jun 17, 2026 · jqlang jq
jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 11, 2026 · NIST NVD
Detected
jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects.
Jun 17, 2026 · NIST NVD
Updated
jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects.
Affected
- cpe jqlang/jqversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-43896
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-43896
jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects.
nvd.nist.gov