A critical algorithmic complexity vulnerability in the jq JSON processor allows unauthenticated attackers to trigger denial of service conditions through high CPU consumption.

The application utilizes the MurmurHash3 function with a hardcoded, publicly known seed for JSON hash table operations. This allows an unauthenticated attacker to supply a specially crafted JSON object that forces hash collisions, degrading performance from linear to quadratic time and resulting in significant CPU exhaustion.

Successful exploitation leads to a denial of service, rendering applications or automated pipelines that rely on jq for data processing unresponsive. With a CVSS score of 7.5, this high-severity flaw poses a significant risk to CI/CD pipelines, web services, and data processing scripts, potentially causing widespread operational disruption and service outages.

Immediate Action: Update jq to the version containing commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784 or later.

Proactive Monitoring: Monitor server CPU utilization and task execution times for sudden, sustained spikes that may indicate algorithmic complexity attacks on JSON processing endpoints.

Compensating Controls: Implement resource limits on processing tasks, such as CPU time quotas or input size validation, to prevent malicious payloads from exhausting system resources.

Public Exploit Available: No confirmed public exploit (Metasploit/ExploitDB/public PoC) is available in the provided data.

Given the ease of exploitation and the potential for severe service degradation, organizations should prioritize updating their jq instances immediately. Automated systems that process untrusted JSON input are at the highest risk and should be patched without delay to prevent denial of service attacks.