CVE-2026-40612EPSS p5.2%
CVE-2026-40612CVE-2026-40612
jqlang / jq
Description
jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since the JSON parser caps at depth 10000), the C stack is exhausted.
Scoring
| CVSS | 5.5 () |
| Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
| EPSS | 0.16% probability of exploitation · percentile 5.2% · 2026-10-27T12:03:15Z |
| Last modified | 2026-10-26 |