CVE-2026-40164

jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n), turning any jq expression into an O(n²) operation and causing significant CPU exhaustion. This affected common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more practical to exploit than existing heap overflow issues since it required only a small payload. This issue has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-328",
        "CWE-407"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40164.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "fixed":  "0c7d133c3c7e37c00b6d46b658a02244fdd3c784"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/jqlang/jq

Affected ranges

Type

GIT

Repo

https://github.com/jqlang/jq

Events

Introduced

Fixed

0c7d133c3c7e37c00b6d46b658a02244fdd3c784

Database specific

Show details

{
    "source":  "REFERENCES"
}

Affected versions

1.*

1.6rc2

jq-1.*

jq-1.0

jq-1.1

jq-1.2

jq-1.3

jq-1.4

jq-1.5rc1

jq-1.5rc2

jq-1.6

jq-1.6rc1

jq-1.7

jq-1.7.1

jq-1.7rc1

jq-1.7rc2

jq-1.8.0

jq-1.8.1

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-40164.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "40767225329927328445769865555316188476",
                "58113614829326776963612530023344680668",
                "149125579468807480806765829321659268047",
                "255056121678116637219209663431357356880",
                "259745096664922749560488579717127570089",
                "82739521328169738112075331161488465078",
                "335442583615051330670187537955032670700",
                "11424449149007967193341622669435805816",
                "157070531992953830517115695855359128872",
                "25667657606560363609447882023862575225",
                "192940216498668013421906925231866311531",
                "42862664772594035153289470484226969372"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-40164-8aa3ee2f",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/jqlang/jq/commit/0c7d133c3c7e37c00b6d46b658a02244fdd3c784",
        "target":  {
            "file":  "src/jv.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "123968419695391302376873502349968234100",
            "length":  1058
        },
        "id":  "CVE-2026-40164-ef6ca8a1",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/jqlang/jq/commit/0c7d133c3c7e37c00b6d46b658a02244fdd3c784",
        "target":  {
            "file":  "src/jv.c",
            "function":  "jvp_string_hash"
        }
    }
]

vanir_signatures_modified

"2026-09-02T08:12:56Z"