CVE-2026-33947 jqlang CVE debrief

Who should care

Defenders responsible for applications or services that process untrusted JSON input through jq should assess exposure and apply the patch. This includes developers, system administrators, and security teams.

Why it matters

CVE-2026-33947 is a denial-of-service vulnerability in jq that can cause an unrecoverable crash in applications processing untrusted JSON input. Defenders should assess exposure, apply the patch, and monitor for potential attacks.

• Denial of service (unrecoverable crash) in applications processing untrusted JSON input through jq
• Potential for attackers to exploit the vulnerability to cause a crash
• Need for defenders to verify affected versions and apply the patch
• Importance of monitoring for potential denial-of-service attacks

Technical summary

The vulnerability is caused by unbounded recursion in jq's src/jv_aux.c, specifically in the jv_setpath(), jv_getpath(), and delpaths_sorted() functions. This can be triggered by a JSON document containing a flat array of approximately 65,000 integers, which can exhaust the C call stack and cause a segmentation fault. The existing MAX_PARSING_DEPTH limit does not apply to runtime path operations. The impact is denial of service (unrecoverable crash) affecting any application or service that processes untrusted JSON input through jq's setpath, getpath, or delpaths builtins.

Defensive priority

Defenders should prioritize assessing exposure and applying the patch, as the vulnerability can cause an unrecoverable crash in applications processing untrusted JSON input through jq.

Recommended defensive actions

• Assess exposure by checking if jq versions 1.8.1 or below are in use
• Apply the patch from commit fb59f1491058d58bdc3e8dd28f1773d1ac690a1f
• Monitor for potential denial-of-service attacks
• Consider implementing compensating controls to mitigate the impact of a potential attack
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by unbounded recursion in jq's src/jv_aux.c, which can be triggered by a JSON document containing a flat array of approximately 65,000 integers. The existing MAX_PARSING_DEPTH limit does not apply to runtime path operations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.