CVE-2016-4074: The jv_dump_term function in jq 1.5 allows remote attackers to cause a denial of service (stack consumption...

Security readout for executives and security teams

CVE-2016-4074 is a denial-of-service flaw in jq 1.5. A specially crafted JSON file can trigger excessive stack use in jq’s output handling and crash the application using it. The public record says it was fixed in jq 1.6_rc1-r0. There is no cited evidence of active exploitation. Exposure is most likely where jq 1.5 processes JSON supplied by users, partners, network services, CI jobs, or automation pipelines. Systems using jq only on trusted local data have lower practical risk. Treat as a targeted availability risk. Prioritize internet-facing or business-critical automation that processes untrusted JSON with jq 1.5. It is less urgent than remote code execution, but easy dependency cleanup may reduce outage risk. Mitigation focus: Inventory jq versions across hosts, containers, build images, and embedded tooling.; Upgrade jq 1.5 to jq 1.6_rc1-r0 or vendor-supported later fixed packages.; If upgrading is delayed, avoid processing untrusted JSON with jq 1.5..

Prepared

Jun 13, 2026, 19:12 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.