CVE-2026-44777: jq: stack overflow in module loading on mutual `include`
jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two otherwise valid modules include each other.
Other sources
jq: stack overflow in module loading on mutual include
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/jqto a version that resolves this vulnerability.Fixed in 1.6-2.1+deb12u2Fixed in 1.6-2.1+deb12u3Fixed in 1.7.1-6+deb13u3Fixed in 1.7.1-6+deb13u4Fixed in 1.8.2-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44777?
CVE-2026-44777 has a high severity due to the potential for stack overflow and application crashes.
How do I fix CVE-2026-44777?
To fix CVE-2026-44777, upgrade jq to version 1.8.2rc2 or later where the issue has been addressed.
What versions of jq are affected by CVE-2026-44777?
CVE-2026-44777 affects jq versions up to and including 1.8.2rc1.
What is the impact of CVE-2026-44777 on applications using jq?
The impact of CVE-2026-44777 includes potential crashes or resource exhaustion when modules include each other.
Is there a workaround for CVE-2026-44777 if I cannot update jq?
A possible workaround for CVE-2026-44777 is to avoid using mutual includes in jq modules.