PT-2026-32565 · Jq+4 · Jq+4
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
jq versions prior to commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784
Description
The software used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table operations. This allows an attacker to precompute key collisions offline and supply a crafted JSON object where all keys hash to the same bucket. Consequently, hash table lookups degrade from O(1) to O(n), transforming jq expressions into O(n²) operations and causing significant CPU exhaustion. This issue impacts CI/CD pipelines, web services, and data processing scripts.
Recommendations
Update to the version containing commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784.
Exploit
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linuxmint
Red Os
Rocky Linux
Ubuntu
Jq