The vulnerability is an unbounded recursion in jv_equal() and jv_cmp() that causes a stack overflow when processing deeply nested JSON structures during equality checks (==, !=) or comparisons (sort, unique, bsearch, min_by, max_by).