jq is a command‑line JSON processor in which, up to and including version 1.8.1, the internal functions jv_setpath, jv_getpath, and delpaths_sorted perform recursive traversals that are bounded only by the length of a caller‑supplied path array. An attacker can construct a JSON document containing a flat array of roughly 65,000 integers (about 200 KB) and use it as a path argument for a trusted jq filter. This causes the functions to recurse deeply, exhausting the C call stack and resulting in a segmentation fault. The failure is unrecoverable, bringing the process to a halt, and therefore constitutes a denial‑of‑service condition. The weakness is identified as CWE‑674: Uncontrolled Recursion.

The vulnerability affects the jq JSON processor supplied by the jqlang project. Any deployment of jq version 1.8.1 or earlier is susceptible. This includes any application or service that incorporates jq and passes untrusted JSON through the setpath, getpath, or delpaths built‑in functions, regardless of the operating system or environment.

The CVSS base score of 6.2 reflects moderate severity. No EPSS score is available, and the issue is not listed in CISA’s KEV catalog. Attackers can trigger the crash by providing a crafted JSON payload to any service that evaluates it with jq. Because the recursion depth is not bounded at runtime, an attacker can perform the exploit from a remote connection that feeds JSON to the service or, locally, from any input channel that reaches the vulnerable jq functions. The impact remains a service outage, and given the ease of creating the payload and lack of additional mitigations in affected releases, the risk of exploitation remains significant.