NVD Vulnerability Detail
Search Exploit, PoC
CVE-2026-40612
Summary

jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since the JSON parser caps at depth 10000), the C stack is exhausted.

Publication Date May 12, 2026, 3:16 a.m.
Registration Date May 12, 2026, 4:14 a.m.
Last Update May 12, 2026, 3:16 a.m.
Related information, measures and tools
Common Vulnerabilities List