CVE-2026-47770

Name of the Vulnerable Software and Affected Versions jq versions prior to 1.8.2

Description Comparing two deeply nested arrays using the == operator can lead to a denial of service through stack exhaustion caused by uncontrolled recursion. The issue occurs within the recursive structural comparison code, specifically involving the jvp array equal() and jv equal() functions in src/jv.c. Additionally, a sort comparator path through the jv cmp() function in src/jv aux.c can also cause a stack overflow at a greater nesting depth due to a missing recursion guard. This affects users who perform comparisons on attacker-controlled deeply nested JSON values or embed the software in environments where untrusted data reaches the == comparison path.

Recommendations Update to version 1.8.2.