The jvdumpterm function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted JSON file. This issue has been fixed in jq 1.6_rc1-r0.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-4074.json"