A recursion limit is not enforced in jv_contains, causing the C stack to overflow when jq processes deeply nested arrays or objects. The result is a crash of the jq process, which can be exploited for denial of service. The weakness is a classic example of unchecked recursion (CWE-674).

The vulnerability affects the jq command‑line JSON processor distributed by jqlang. Versions 1.8.1 and earlier are susceptible; later releases are presumed fixed.

The CVSS score of 5.4 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Based on the nature of jq as a command‑line tool, it is inferred that the most likely exploitation scenario involves an attacker delivering a deeply nested JSON file that is processed by jq, such as through an automated build pipeline or a user‑supplied script. This inference is not explicitly stated in the CVE description.