CVE-2026-33947 jq: Unbounded Recursion in jv_setpath(), jv_getpath() and delpaths_sorted()
An attacker can crash applications using jq by supplying a large JSON array to path operations, causing stack exhaustion and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33947?
CVE-2026-33947 is a medium-severity denial of service vulnerability in jqlang jq, published on 13 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(), and delpaths_sorted() in jq's src/jv_aux.c use unbounded recursion whose depth is controlled by the length of a caller-supplied path array, with no depth limit enforced. An attacker can supply a JSON document containing a flat array of ~65,000 integers (~200 KB) that, when used as a path argument by a trusted jq filter, exhausts the C call stack and crashes the process with a segmentation fault (SIGSEGV). This bypass works because the existing MAX_PARSING_DEPTH (10,000) limit only protects the JSON parser, not runtime path operations where arrays can be programmatically constructed to arbitrary lengths. The impact is denial of service (unrecoverable crash) affecting any application or service that processes untrusted JSON input through jq's setpath, getpath, or delpaths builtins. This issue has been addressed in commit fb59f1491058d58bdc3e8dd28f1773d1ac690a1f.
Weakness: CWE-674
Which versions are affected by CVE-2026-33947?
It affects 1 product.
Products include Jqlang Jq.
How do I fix CVE-2026-33947?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-33947 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33947 exists.
Other vulnerabilities in jqlang jq
- CVE-2026-32316 jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow
- CVE-2024-53427 Memory corruption in jq
- CVE-2025-48060 AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt)
- CVE-2023-49355 Memory corruption in n/a
- CVE-2026-49839 jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow
Sources
Also known as ALPINE-CVE-2026-33947, AZL-82925, BELL-CVE-2026-33947, DEBIAN-CVE-2026-33947, ECHO-a573-f4d9-1605, GHSA-xwrw-4f8h-rjvg.