jq, a command‑line JSON processor, can crash when a user runs a crafted program that forces jv_object_merge_recursive() to recurse without bound. The recursion is reached through the * operator applied to two objects, resulting in a stack overflow and a segmentation fault. The crash disables the jq instance, leading to a denial of service of the processing task but does not expose data or privilege escalation directly.

The vulnerability affects jqlang’s jq versions 1.8.1 and earlier. No newer releases contain the flaw. Users employing these versions on any platform where jq is executed are at risk if they run untrusted jq scripts.

The CVSS score of 6.2 indicates medium impact and local availability of the flaw; the EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting limited or no known active exploitation. Attackers must supply and execute a malicious jq program, so the primary attack vector is local or requires exploitation of a service that runs jq on untrusted input. The risk is moderate, with a lower likelihood of exploitation until the vulnerability is documented and mitigated.