Loading vulnerability…
Hash-Collision Denial of Service in jq
CVE-2026-40164 is an algorithmic-complexity vulnerability in jq's JSON object hash tables. Vulnerable builds use MurmurHash3 with a hardcoded, publicly known seed, allowing attackers to precompute colliding object keys offline. Processing a crafted JSON object of approximately 100 KB whose keys map to the same bucket degrades hash-table lookups from expected O(1) to O(n), producing O(n²) object-processing behavior and significant CPU exhaustion. The vulnerability affects builds without the upstream fix or an equivalent vendor backport.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Attacker-controlled JSON can cause excessive CPU consumption and denial of service in jq processes and dependent workflows, including CI/CD pipelines, web services, and data-processing scripts. A relatively small input can cause disproportionate processing delays and resource contention. No confidentiality or integrity impact is established.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Deploy the upstream fix or the applicable vendor security update.
Patch, then assume compromise.
Install a jq build containing upstream commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784 or an equivalent vendor backport. For the specified RHEL 8.8 support streams, update to jq package release 1.6-6.el8_8.4 or a superseding fixed release under RHSA-2026:18046. For the specified RHEL 8.4 support streams, update to 1.5-12.el8_4.5 or a superseding fixed release under RHSA-2026:18048. Update bundled jq copies through the applicable product security release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
64 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.