Log in Start free

Vulnerability · Published Apr 13, 2026 · Assigned by GitHub_M

CVE-2026-40164jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seed

High 7.5

In plain English

A high-severity security flaw in jq from jqlang. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 69.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n), turning any jq expression into an O(n²) operation and causing significant CPU exhaustion. This affected common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more practical to exploit than existing heap overflow issues since it required only a small payload. This issue has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10jq1.7.1-11.el10_2.2ALSA-2026:19151
AlmaLinux:10jq1.7.1-11.el10_1.0.2ALSA-2026:16692
AlmaLinux:8jq1.6-12.el8_10ALSA-2026:16252
AlmaLinux:9jq1.6-19.el9_8.2ALSA-2026:19365
AlmaLinux:9jq1.6-19.el9_7.0.2ALSA-2026:16693
AlmaLinux:10jq-devel1.7.1-11.el10_1.0.2ALSA-2026:16692
AlmaLinux:10jq-devel1.7.1-11.el10_2.2ALSA-2026:19151
AlmaLinux:8jq-devel1.6-12.el8_10ALSA-2026:16252
AlmaLinux:9jq-devel1.6-19.el9_8.2ALSA-2026:19365
AlmaLinux:9jq-devel1.6-19.el9_7.0.2ALSA-2026:16693
Alpine:v3.22jq1.8.2-r0ALPINE-CVE-2026-40164
Alpine:v3.23jq1.8.2-r0ALPINE-CVE-2026-40164
Alpine:v3.24jq1.8.2-r0ALPINE-CVE-2026-40164
Debian:12jq1.6-2.1+deb12u2DEBIAN-CVE-2026-40164
Debian:13jq1.7.1-6+deb13u2DEBIAN-CVE-2026-40164
Debian:14jq1.8.1-5DEBIAN-CVE-2026-40164
Rocky Linux:10jq0:1.7.1-11.el10_1.0.2RLSA-2026:16692
Rocky Linux:10jq0:1.7.1-11.el10_2.2RLSA-2026:19151
Rocky Linux:8jq0:1.6-12.el8_10RLSA-2026:16252
Rocky Linux:9jq0:1.6-19.el9_8.2RLSA-2026:19365
Rocky Linux:9jq0:1.6-19.el9_7.0.2RLSA-2026:16693
Ubuntu:22.04:LTSjq1.6-2.1ubuntu3.2UBUNTU-CVE-2026-40164
Ubuntu:22.04:LTSjq1.6-2.1ubuntu3.2USN-8202-1
Ubuntu:24.04:LTSjq1.7.1-3ubuntu0.24.04.2UBUNTU-CVE-2026-40164
Ubuntu:24.04:LTSjq1.7.1-3ubuntu0.24.04.2USN-8202-1
Ubuntu:25.10jq1.8.1-3ubuntu1.1USN-8202-1
Ubuntu:25.10jq1.8.1-3ubuntu1.1UBUNTU-CVE-2026-40164
Ubuntu:26.04:LTSjq1.8.1-4ubuntu2UBUNTU-CVE-2026-40164

Affected products (as reported)

VendorProductVersions
jqlang jq < 0c7d133c3c7e37c00b6d46b658a02244fdd3c784

Weakness: CWE-328, CWE-407, CWE-341 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References