CVE-2026-40164: Jqlang Jq

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n), turning any jq expression into an O(n²) operation and causing significant CPU exhaustion. This affected common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more practical to exploit than existing heap overflow issues since it required only a small payload. This issue has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784.

Affected products

Jqlang Jq: before 0c7d133c3c7e37c00b6d46b658a02244fdd3c784 (fixed in 0c7d133c3c7e37c00b6d46b658a02244fdd3c784)
Red Hat Red Hat Ai Inference Server 3.2: before 1780681984 (fixed in 1780681984)
Red Hat Red Hat Ai Inference Server 3.3: before 1782352950 (fixed in 1782352950); before 1782352919 (fixed in 1782352919); before 1782353093 (fixed in 1782353093); before 1782352847 (fixed in 1782352847)
Red Hat Red Hat Enterprise Linux 10: before 0:1.7.1-11.el10_1.0.2 (fixed in 0:1.7.1-11.el10_1.0.2)
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support: before 0:1.7.1-8.el10_0.3 (fixed in 0:1.7.1-8.el10_0.3)
Red Hat Red Hat Enterprise Linux 8: before 0:1.6-12.el8_10 (fixed in 0:1.6-12.el8_10)
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: before 0:1.5-12.el8_4.5 (fixed in 0:1.5-12.el8_4.5)
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On: before 0:1.5-12.el8_4.5 (fixed in 0:1.5-12.el8_4.5)
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: before 0:1.6-3.el8_6.2 (fixed in 0:1.6-3.el8_6.2)
Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service: before 0:1.6-3.el8_6.2 (fixed in 0:1.6-3.el8_6.2)
Red Hat Red Hat Enterprise Linux 8.6 Update Services For SAP Solutions: before 0:1.6-3.el8_6.2 (fixed in 0:1.6-3.el8_6.2)
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service: before 0:1.6-6.el8_8.4 (fixed in 0:1.6-6.el8_8.4)
Red Hat Red Hat Enterprise Linux 8.8 Update Services For SAP Solutions: before 0:1.6-6.el8_8.4 (fixed in 0:1.6-6.el8_8.4)
Red Hat Red Hat Enterprise Linux 9: before 0:1.6-19.el9_7.0.2 (fixed in 0:1.6-19.el9_7.0.2)
Red Hat Red Hat Enterprise Linux 9.0 Update Services For SAP Solutions: before 0:1.6-12.el9_0.3 (fixed in 0:1.6-12.el9_0.3)
Red Hat Red Hat Enterprise Linux 9.2 Update Services For SAP Solutions: before 0:1.6-15.el9_2.3 (fixed in 0:1.6-15.el9_2.3)
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support: before 0:1.6-16.el9_4.2 (fixed in 0:1.6-16.el9_4.2)
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support: before 0:1.6-17.el9_6.4 (fixed in 0:1.6-17.el9_6.4)
Red Hat Red Hat Hardened Images: before 1.8.1-3.hum1 (fixed in 1.8.1-3.hum1)
Red Hat Red Hat Openshift Container Platform 4.12: before 412.86.202606140301-0 (fixed in 412.86.202606140301-0)
Red Hat Red Hat Openshift Container Platform 4.13: before 413.92.202606160406-0 (fixed in 413.92.202606160406-0)
Red Hat Red Hat Openshift Container Platform 4.14: before 414.92.202606231112-0 (fixed in 414.92.202606231112-0)
Red Hat Red Hat Openshift Container Platform 4.15: before 415.92.202606030318-0 (fixed in 415.92.202606030318-0)
Red Hat Red Hat Openshift Container Platform 4.16: before 416.94.202606051757-0 (fixed in 416.94.202606051757-0)
Red Hat Red Hat Openshift Container Platform 4.17: before 417.94.202606250942-0 (fixed in 417.94.202606250942-0)
and 2 more

Published 2026-04-14. Last modified 2026-07-15.