Uncontrolled Recursion in jq - CVE-2026-33947

Vulnerability identifier: #VU125831

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-33947

CWE-ID: CWE-674

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to uncontrolled recursion in the "jv_setpath()", "jv_getpath()" and "delpaths_sorted()" functions in src/jv_aux.c. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

jq
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
Ubuntu
Basesystem Module
openEuler
Anolis OS
Fedora
LANTIME Operating System Firmware (LTOS)
jq (Ubuntu package)
jq-debugsource
jq
libjq-devel
libjq1
libjq1-debuginfo
jq-debuginfo
jq-help
jq-devel
jq-doc

Install update from vendor's website.

jq - update to 1.8.2
LANTIME Operating System Firmware (LTOS) - update to 7.10.013
jq (Ubuntu package) - addressed in versions 1.3-1.1ubuntu1.1+esm4, 1.5+dfsg-1ubuntu0.1+esm4, 1.5+dfsg-2ubuntu0.1~esm2, 1.5+dfsg-2ubuntu0.1~esm3, 1.6-1ubuntu0.20.04.1+esm2, 1.6-1ubuntu0.20.04.1+esm3, 1.6-2.1ubuntu3.2, 1.7.1-3ubuntu0.24.04.2, 1.8.1-3ubuntu1.1, 1.8.1-4ubuntu2
jq-debugsource - update to 1.6-150000.3.20.1
jq - update to 1.6-150000.3.20.1
libjq-devel - update to 1.6-150000.3.20.1
libjq1 - update to 1.6-150000.3.20.1
libjq1-debuginfo - update to 1.6-150000.3.20.1
jq-debuginfo - update to 1.6-150000.3.20.1
jq-help - update to 1.8.0-3
jq-devel - update to 1.8.0-3
jq-debugsource - update to 1.8.0-3
jq-debuginfo - update to 1.8.0-3
jq - update to 1.8.0-3
jq - update to 1.8.1-3.fc44
jq - update to 1.8.1-4
jq-doc - update to 1.8.1-4
jq-devel - update to 1.8.1-4

• Exploit #12581 - Unbounded Recursion in jv_setpath() / jv_getpath() / delpaths_sorted() (April 13, 2026)

• https://github.com/jqlang/jq/security/advisories/GHSA-xwrw-4f8h-rjvg

• Multiple vulnerabilities in jq
• Fedora 44 update for jq
• Anolis OS update for jq
• openEuler update for jq
• Ubuntu update for jq
• Ubuntu update for jq
• Ubuntu update for jq
• SUSE update for jq
• Multiple vulnerabilities in Meinberg LANTIME firmware