Asafmeizner

**Name of the Vulnerable Software and Affected Versions** jq versions prior to commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784 **Description** The software used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table operations. This allows an attacker to precompute key collisions offline and supply a crafted JSON object where all keys hash to the same bucket. Consequently, hash table lookups degrade from O(1) to O(n), transforming jq expressions into O(n²) operations and causing significant CPU exhaustion. This issue impacts CI/CD pipelines, web services, and data processing scripts. **Recommendations** Update to the version containing commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784.