CVE-2026-44777

jq: stack overflow in module loading on mutual `include` PUBLISHED

Description (CNA)

jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two otherwise valid modules include each other.

Affected (CNA)

Vendor / product	Versions
jqlang / jq	affected <= 1.8.2rc1

CWE

CWE-674

References

https://github.com/jqlang/jq/security/advisories/GHSA-rmpv-jgvr-wpr9

ADP enrichment

CISA-ADP

No English description supplied.

https://github.com/jqlang/jq/security/advisories/GHSA-rmpv-jgvr-wpr9