{"id":"CVE-2026-40164","summary":"jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seed","details":"jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n), turning any jq expression into an O(n²) operation and causing significant CPU exhaustion. This affected common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more practical to exploit than existing heap overflow issues since it required only a small payload. This issue has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784.","aliases":["GHSA-wwj8-gxm6-jc29"],"modified":"2026-07-23T18:29:45.178821571Z","published":"2026-04-13T23:40:12.693Z","related":["ALSA-2026:16252","ALSA-2026:16692","ALSA-2026:16693","ALSA-2026:19151","ALSA-2026:19365","SUSE-SU-2026:22545-1","SUSE-SU-2026:22566-1","SUSE-SU-2026:22664-1","SUSE-SU-2026:22705-1","SUSE-SU-2026:2983-1","openSUSE-SU-2026:10850-1","openSUSE-SU-2026:21248-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-328","CWE-407"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40164.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"fixed":"0c7d133c3c7e37c00b6d46b658a02244fdd3c784"}]}]},"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40164.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16252"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16692"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16693"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:18040"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:18042"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:18043"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:18044"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:18045"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:18046"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:18047"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:18048"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19151"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19365"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23233"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23245"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25044"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25096"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25181"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26528"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26542"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28887"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30078"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30087"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30088"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30089"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34098"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8579"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-40164"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40164.json"},{"type":"ADVISORY","url":"https://github.com/jqlang/jq/security/advisories/GHSA-wwj8-gxm6-jc29"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40164"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458084"},{"type":"FIX","url":"https://github.com/jqlang/jq/commit/0c7d133c3c7e37c00b6d46b658a02244fdd3c784"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jqlang/jq","events":[{"introduced":"0"},{"fixed":"0c7d133c3c7e37c00b6d46b658a02244fdd3c784"}],"database_specific":{"source":"REFERENCES"}}],"versions":["jq-1.8.1","jq-1.8.0","jq-1.7.1","jq-1.7","jq-1.7rc2","jq-1.7rc1","jq-1.6","1.6rc2","jq-1.6rc1","jq-1.5rc2","jq-1.5rc1","jq-1.4","jq-1.3","jq-1.2","jq-1.1","jq-1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40164.json","vanir_signatures_modified":"2026-07-22T04:28:04Z","vanir_signatures":[{"digest":{"line_hashes":["40767225329927328445769865555316188476","58113614829326776963612530023344680668","149125579468807480806765829321659268047","255056121678116637219209663431357356880","259745096664922749560488579717127570089","82739521328169738112075331161488465078","335442583615051330670187537955032670700","11424449149007967193341622669435805816","157070531992953830517115695855359128872","25667657606560363609447882023862575225","192940216498668013421906925231866311531","42862664772594035153289470484226969372"],"threshold":0.9},"id":"CVE-2026-40164-8aa3ee2f","signature_type":"Line","signature_version":"v1","source":"https://github.com/jqlang/jq/commit/0c7d133c3c7e37c00b6d46b658a02244fdd3c784","target":{"file":"src/jv.c"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/jqlang/jq/commit/0c7d133c3c7e37c00b6d46b658a02244fdd3c784","target":{"file":"src/jv.c","function":"jvp_string_hash"},"deprecated":false,"digest":{"function_hash":"123968419695391302376873502349968234100","length":1058},"id":"CVE-2026-40164-ef6ca8a1","signature_type":"Function"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}