jq, a command‑line JSON processor, has a flaw that can cause a stack overflow when comparing two deeply nested JSON arrays with the == operator. The lack of a recursion guard in jq’s structural comparison code leads to uncontrolled recursion, ultimately crashing the program. The impact is a denial of service; the attacker cannot gain arbitrary code execution but can make the tool or any service that relies on it unavailable. The weakness corresponds to CWE‑674, uncontrolled recursion.

The vulnerability affects all installations of jqlang’s jq version earlier than 1.8.2. Any environment that runs jq on user‑supplied or untrusted JSON – such as scripts, build pipelines, or data‑processing services – can be impacted. Updated releases from 1.8.2 onward are not affected.

With a CVSS score of 6.8, the risk is moderate. No EPSS data are available, and the issue is not listed in CISA’s KEV catalog, suggesting it is not widely exploited yet. The exploit requires the attacker to supply or influence deeply nested JSON to jq, which can be feasible in contexts where untrusted data are fed to jq, like web services or CI/CD scripts. Due to the lack of a remote code execution vector, the primary threat is service interruption rather than full compromise.