CVE-2026-40164

jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n), turning any jq expression into an O(n²) operation and causing significant CPU exhaustion. This affected common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more practical to exploit than existing heap overflow issues since it required only a small payload. This issue has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40164.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "0c7d133c3c7e37c00b6d46b658a02244fdd3c784"
                }
            ]
        }
    ],
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-328",
        "CWE-407"
    ]
}

References

Affected packages

Git / github.com/jqlang/jq

Affected ranges

Type

GIT

Repo

https://github.com/jqlang/jq

Events

Introduced

Fixed

0c7d133c3c7e37c00b6d46b658a02244fdd3c784

Database specific

{
    "source": "REFERENCES"
}

Affected versions

1.*

1.6rc2

jq-1.*

jq-1.0

jq-1.1

jq-1.2

jq-1.3

jq-1.4

jq-1.5rc1

jq-1.5rc2

jq-1.6

jq-1.6rc1

jq-1.7

jq-1.7.1

jq-1.7rc1

jq-1.7rc2

jq-1.8.0

jq-1.8.1

Database specific

vanir_signatures_modified

"2026-07-22T04:28:04Z"

vanir_signatures

[
    {
        "id": "CVE-2026-40164-8aa3ee2f",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "40767225329927328445769865555316188476",
                "58113614829326776963612530023344680668",
                "149125579468807480806765829321659268047",
                "255056121678116637219209663431357356880",
                "259745096664922749560488579717127570089",
                "82739521328169738112075331161488465078",
                "335442583615051330670187537955032670700",
                "11424449149007967193341622669435805816",
                "157070531992953830517115695855359128872",
                "25667657606560363609447882023862575225",
                "192940216498668013421906925231866311531",
                "42862664772594035153289470484226969372"
            ]
        },
        "signature_type": "Line",
        "target": {
            "file": "src/jv.c"
        },
        "source": "https://github.com/jqlang/jq/commit/0c7d133c3c7e37c00b6d46b658a02244fdd3c784",
        "deprecated": false
    },
    {
        "id": "CVE-2026-40164-ef6ca8a1",
        "signature_version": "v1",
        "digest": {
            "function_hash": "123968419695391302376873502349968234100",
            "length": 1058.0
        },
        "signature_type": "Function",
        "target": {
            "function": "jvp_string_hash",
            "file": "src/jv.c"
        },
        "source": "https://github.com/jqlang/jq/commit/0c7d133c3c7e37c00b6d46b658a02244fdd3c784",
        "deprecated": false
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40164.json"