Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-06 | 1 | General1 |
| 2026-05-11 | 1 | Disclosure1 |
| 2026-06-03 | 1 | Disclosure1 |
I made a blog, I will be writing there about RE, Malware, VR. For the first post, I wrote a short breakdown of a recent bug I found in jq: CVE-2026-43896. Hope you enjoy it ; ) https://nullbyte0x.github.io/#/post/research/jq-object-merge-stack-overflow
Post summary
A blog author announces they discovered CVE-2026-43896 in jq and intends to write a short breakdown; no PoC, exploit, patch, or detailed technical information is provided.
CVE-2026-43896 jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a … https://www.cve.org/CVERecord?id=CVE-2026-43896
Post summary
The statement discloses an unbounded recursion flaw in jq 1.8.1 and earlier that can crash processes with crafted programs, providing technical details but no exploit, patch, or exploitation confirmation.
🪟 jq DoS CVE-2026-43896 is the kind of bug that wrecks “glue code” everywhere—CI, containers, pipelines. Not sexy, but it’ll take down your Windows build faster than a bad script rewrite. https://windowsforum.com/threads/cve-2026-43896-in-jq-recursive-merge-dos-and-why-it-hits-windows-ops.422013/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #WindowsSecurity #DenialOfService #JqVulnerability #CiPipeline https://t.co/Z7aBH4tEX8
Post summary
A new DoS vulnerability (CVE‑2026‑43896) affecting jq's recursive merge has been disclosed, potentially causing disruptions in Windows CI and build pipelines.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | jqlang | jq | - | - | - |