CVE-2026-43896: jq: Stack Overflow in Recursive Object Merge
jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jvobjectmergerecursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the operator when both operands are objects.
Other sources
jq: Stack Overflow in Recursive Object Merge
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/jqto a version that resolves this vulnerability.Fixed in 1.6-2.1+deb12u2Fixed in 1.6-2.1+deb12u3Fixed in 1.7.1-6+deb13u3Fixed in 1.7.1-6+deb13u4Fixed in 1.8.2-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43896?
CVE-2026-43896 is classified as a critical vulnerability due to the potential for unbounded recursion leading to a stack overflow.
How do I fix CVE-2026-43896?
To fix CVE-2026-43896, upgrade jq to version 1.8.2 or later, which addresses the unbounded recursion issue.
What versions of jq are affected by CVE-2026-43896?
CVE-2026-43896 affects jq versions 1.8.1 and earlier.
What kind of vulnerability is CVE-2026-43896?
CVE-2026-43896 is a stack overflow vulnerability that occurs in the recursive object merge function of jq.
How can CVE-2026-43896 be exploited?
CVE-2026-43896 can be exploited by executing a crafted jq program that triggers unbounded recursion, causing a segmentation fault.