Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV L L N N P N N H 6.8 .0015 4.5 —
AFFECTED Product Versions Fixed jq < 1.8.2 – —
TIMELINE May 19 Reserved by GitHub_M Jun 25 EXPLOIT PUBLISHED — CVE-2026-47770 (jqlang jq). Public exploit reference added. Jun 25 Published (CNA: GitHub_M)
jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion (uncontrolled recursion). The crash occurs in jq's recursive structural comparison code, with the recursion repeating through jvp_array_equal() and jv_equal() in src/jv.c when comparing deeply nested arrays; a nearby sort comparator path through jv_cmp() in src/jv_aux.c overflows the stack at a larger nesting depth from the same missing recursion guard. Anyone running jq comparisons on attacker-controlled deeply nested JSON values, or embedding jq in a context where untrusted data can reach the == comparison path, is affected. This vulnerability is fixed in 1.8.2.
| Date | Event | Detail |
|---|---|---|
| May 19, 2026 | Reserved | Reserved by GitHub_M |
| June 25, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-47770 (jqlang jq). Public exploit reference added. |
| June 25, 2026 | Published | Published (CNA: GitHub_M) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| jqlang | jq | — | < 1.8.2 | — |
Authoritative record: CVE-2026-47770 at cve.org
Vendors: jqlang
Weaknesses: CWE-674
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-47770 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.