jq is a command‑line JSON processor that, in older releases, used a hard‑coded MurmurHash3 seed for all hash table operations. An attacker can craft a JSON object that forces all keys to hash to the same bucket, turning each hash lookup from O(1) to O(n) and any jq expression into an O(n²) operation. The resulting CPU exhaustion constitutes a denial of service and represents a resource exhaustion weakness (CWE‑407), the use of a hard‑coded cryptographic component (CWE‑328), and a weak key seed (CWE‑341).

The vulnerability applies to jq releases from the jqlang project that precede commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784. Systems that use jq in CI/CD pipelines, web services, or data‑processing scripts without this patch are affected.

The CVSS score of 7.5 signals high severity, and the EPSS score is very low (0.00036), yet the exploit is trivial to deploy by supplying a 100 KB crafted JSON file. There is no CISA KEV listing yet. Once jq processes the malicious input, the DoS impact is immediate and can affect any machine that runs jq, making the risk substantial for environments that have not applied the patch.