CLSA-2026-1782901522 jq: Fix of CVE-2026-47770

CVE-2026-47770: guard deep structural equality and comparison recursion in jvequal/jvcmp to prevent stack overflow...

CVE-2026-47770

jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion uncontrolled recursion. The crash occurs in jq's recursive...

CVE-2026-47770: Uncontrolled Recursion

jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion uncontrolled recursion. The crash occurs in jq's recursive...

jq:jq_fuzz_fixed: Crash in jv_free

Project: https://github.com/jqlang/jq.git Detailed Report: https://oss-fuzz.com/testcase?key=5266623017058304 Project: jq Fuzzing Engine: libFuzzer Fuzz Target: jqfuzzfixed Job Type: libfuzzerubsanjq Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x5854898d0001 Crash State: jvfree...

jq:jq_fuzz_fixed: Crash in jvp_object_free

Project: https://github.com/jqlang/jq.git Detailed Report: https://oss-fuzz.com/testcase?key=5098395172667392 Project: jq Fuzzing Engine: libFuzzer Fuzz Target: jqfuzzfixed Job Type: libfuzzerubsanjq Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x5bcd2e830297 Crash State:...

OSV-2024-396 UNKNOWN READ in jvp_object_free

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65942 Crash type: UNKNOWN READ Crash state: jvpobjectfree jvfree jvequal...

jq:jq_fuzz_fixed: Crash in jvp_object_free

Project: https://github.com/jqlang/jq.git Detailed Report: https://oss-fuzz.com/testcase?key=5913670479577088 Project: jq Fuzzing Engine: libFuzzer Fuzz Target: jqfuzzfixed Job Type: libfuzzerubsanjq Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0000000903e7 Crash State:...