jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion (uncontrolled recursion). The crash occurs in jq's recursive structural comparison code, with the recursion repeating through jvparrayequal() and jvequal() in src/jv.c when comparing deeply nested arrays; a nearby sort comparator path through jvcmp() in src/jvaux.c overflows the stack at a larger nesting depth from the same missing recursion guard. Anyone running jq comparisons on attacker-controlled deeply nested JSON values, or embedding jq in a context where untrusted data can reach the == comparison path, is affected. This vulnerability is fixed in 1.8.2.
Anthropic posted a blog yesterday giving an update on their Project Glasswing efforts to find, report, and disclose vulnerabilities in a wide range of software: https://www.anthropic.com/research/glasswing-initial-update
In it, they link to their new disclosure dashboard at: https://red.anthropic.com/2026/cvd/
It currently says: "As of May 22, 2026, we've disclosed 1,596 vulnerabilities across 281 open source projects. To our knowledge, 97 of these have been patched. Of those, 88 have been assigned a Common Vulnerabilities and Exposure (CVE) record or a GitHub Security Advisory (GHSA). In other cases, maintainers have shipped a fix without publishing an advisory. The number of vulnerabilities we've disclosed is a subset of the total number of vulnerabilities that Mythos Preview has found, since the process of independent human triage and review is the rate limiting step."
In their chart below that, they clarify that in this case, "disclosed" means "reported to maintainers", not made public.
They include a list of identifiers of their reports (currently up to 1611 entries), but do not show the project name or bug type until the project has fixed the bug.
They also include lists of CVE's and GHSA's that have been published for the issues they've found. The CVE list currently includes CVE's from nginx, jq, wolfSSL, and more. The GHSA list includes libyang, mastodon, freerdp, and more.
-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris
[Disclaimer: while my employer is identified in the blog post as a partner, I am not personally involved with Project Glasswing, and know nothing more about it than what has been publicly disclosed.]
https://github.com/jqlang/jq/releases/tag/jq-1.7.1 lists these two fixes among the changes in this week's release of jq 1.7.1:
CVE-2023-50246: Fix heap buffer overflow in jvpliteralnumberliteral CVE-2023-50268: fix stack-buffer-overflow if comparing nan with payload
They've also published advisories on github for each:
[oss-fuzz] Issue 64771: jq:jqfuzzexecute: Stack-buffer-overflow in decNaNs https://github.com/jqlang/jq/security/advisories/GHSA-7hmr-442f-qc8j
heap-buffer-overflow exists in the function decToString in decNumber.c https://github.com/jqlang/jq/security/advisories/GHSA-686w-5m7m-54vc
The fixes appear to be in: https://github.com/jqlang/jq/commit/c9a51565214eece8f1053089739aea73145bfd6b https://github.com/jqlang/jq/commit/71c2ab509a8628dbbad4bc7b3f98a64aa90d3297
-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris