PT-2026-32541 · Jq+2 · Jq+2

Bg0D-Glitch · Published 2026-04-13 · Updated 2026-05-24 · CVE-2026-33947

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions jq versions 1.8.1 and earlier

Description A command-line JSON processor is subject to a denial of service. The functions jv setpath(), jv getpath(), and delpaths sorted() in src/jv aux.c use unbounded recursion where the depth is controlled by the length of a caller-supplied path array. An attacker can supply a JSON document containing a flat array of approximately 65,000 integers that exhausts the C call stack, resulting in a segmentation fault (SIGSEGV) and a process crash. This occurs because the MAX PARSING DEPTH limit only protects the JSON parser and not runtime path operations.

Recommendations Apply the fix provided in commit fb59f1491058d58bdc3e8dd28f1773d1ac690a1f. Restrict the use of setpath, getpath, and delpaths builtins when processing untrusted JSON input to minimize the risk of exploitation.

Exploit

Fix

DoS

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

BDU:2026-05501

CVE-2026-33947

ECHO-A573-F4D9-1605

OESA-2026-1981

OPENSUSE-SU-2026:10850-1

RHSA-2026:8579

USN-8202-1

USN-8202-2

Affected Products

Linuxmint

Ubuntu

Jq

References · 43

• 🔥 https://github.com/jqlang/jq/security/advisories/GHSA-xwrw-4f8h-rjvg · Exploit
• https://github.com/jqlang/jq/commit/fb59f1491058d58bdc3e8dd28f1773d1ac690a1f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40164 · Security Note
• https://ubuntu.com/security/CVE-2026-33948 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8202-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32316 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33947 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10850-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05501 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33947 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8202-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33948 · Security Note
• https://ubuntu.com/security/CVE-2026-39956 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8202-2 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33947 · Vendor Advisory