Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2026-43896 is a medium-severity Uncontrolled Recursion (CWE-674) vulnerability in Jqlang Jq. Its CVSS base score is 6.2 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SC-39 (Process Isolation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-29174
Vulnerability Data
jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Uncontrolled recursion (CWE-674) in jq directly enables local application crash via crafted input, matching Endpoint DoS via software exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly blocks the crafted jq program containing the recursive * object-merge expression before it reaches jv_object_merge_recursive.
Runs the jq process in an isolated address space so the uncontrolled recursion crash cannot affect other system components.
Monitors for anomalous jq process behavior (stack growth, segfaults, or resource exhaustion) that signals exploitation of the recursion flaw.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent coding errors such as missing recursion limits or termination conditions.
Runtime monitoring of compute resources can detect excessive consumption caused by uncontrolled recursion.
Vulnerability identification processes can discover and record uncontrolled recursion flaws before deployment.
Capacity monitoring and resource provisioning can absorb or limit the impact of runaway recursion.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect excessive recursion via static analysis or fuzzing.
Secure development life cycle requires controls that prevent uncontrolled recursion through design and code review.
Application security requirements can mandate recursion limits or stack-depth checks.
Secure system architecture principles include resource-management and input-validation rules that limit recursion.
Secure coding standards directly prohibit or constrain recursive constructs that could exhaust stack or memory.
Capacity management includes monitoring and limits that mitigate resource exhaustion from runaway recursion.