CVE-2026-33947

CVE-2026-33947 is a denial-of-service vulnerability affecting jq (command-line JSON processor) versions 1.8.1 and below. The flaw exists in three path manipulation functions—jv_setpath(), jv_getpath(), and delpaths_sorted()—which employ unbounded recursion controlled by attacker-supplied path array lengths. An adversary can craft a JSON document containing a flat array of approximately 65,000 integers that exhausts the C call stack when processed through vulnerable jq filters, resulting in a segmentation fault and process crash. The vulnerability carries a CVSS 3.1 score of 5.5 (Medium severity) with a local attack vector, low complexity, and no special privileges required. The impact is limited to denial of service with no confidentiality or integrity compromise. The underlying cause is that jq's existing MAX_PARSING_DEPTH limit only protects JSON parsing, not runtime path operations where arrays can be programmatically constructed to arbitrary lengths. Currently, there is no evidence of active exploitation in the wild. The vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog, and community attention remains minimal as indicated by low EPSS and FAUCET risk scores. The issue has been remediated in a recent commit, and affected organizations should prioritize updating jq to patched versions, particularly those processing untrusted JSON input through the vulnerable builtin functions.