{"id":"CVE-2026-59168","kind":"vulnerability","aliases":["CVE-2026-59168","GHSA-cqxr-jxr2-85pq","GO-2026-6549"],"related":[],"title":"Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS in github.com/tomwright/dasel","description":"Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/json_reader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard. Deeply nested attacker-controlled JSON or XML supplied through parsing.Format(...).NewReader(...).Read(data), the command-line interface, or the parse selector function can exhaust the Go goroutine stack and raise an unrecoverable fatal error that terminates the entire process. The XML input-size limit does not prevent depth exhaustion, and defer or recover cannot intercept the failure. This issue is fixed in version 3.11.1.","summary":"Dasel, a Go command-line tool and library for querying and transforming JSON, XML and other data, recurses once per nesting level when parsing JSON and XML with no depth limit. Deeply nested attacker-supplied input exhausts the goroutine stack and crashes the whole process, which is a denial of service.","severity":"medium","cvss":6.2,"epss":0.0013,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/tomwright/dasel","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/tomwright/dasel/v2","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/tomwright/dasel/v3","fixed":["3.11.1"],"affected":">= 3.0.0, < 3.11.1","ecosystem":"go"}],"ecosystems":["go"],"tags":["cli","dasel","go","package","self-hosted"],"not_affected_if":["dasel-v2-or-v1-only","no-untrusted-json-or-xml","trusted-input-only"],"how_to_check":"Run `go list -m github.com/tomwright/dasel/v3` and check whether the version is >= 3.0.0 and < 3.11.1.\nIf you call dasel as a library, search your code for parsing.Format(...).NewReader(...) or the parse selector function applied to untrusted input.","fix":"Upgrade github.com/tomwright/dasel/v3 to 3.11.1 or later.","status":"open","published_at":"2026-09-21T17:17:36+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:46:14+00:00","updated_at":"2026-10-23T21:46:14+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:46:14Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/tomwright/dasel/v3 to 3.11.1 or later.\nunknown","reach":"unknown","impact":"low","summary":"Dasel, a Go command-line tool and library for querying and transforming JSON, XML and other data, recurses once per nesting level when parsing JSON and XML with no depth limit. Deeply nested attacker-supplied input exhausts the goroutine stack and crashes the whole process, which is a denial of service.","category":"package","who_cares":["go","dasel","cli","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker crashes the host process with deeply nested JSON or XML input.","analyst_note":"Sources do not say whether the v1 and v2 module paths are patched or still affected; check https://pkg.go.dev/vuln/GO-2026-6549 for the fixed versions of go:github.com/tomwright/dasel and /v2.","how_to_check":"Run `go list -m github.com/tomwright/dasel/v3` and check whether the version is >= 3.0.0 and < 3.11.1.\nIf you call dasel as a library, search your code for parsing.Format(...).NewReader(...) or the parse selector function applied to untrusted input.\nunknown","needs_analyst":true,"not_affected_if":["dasel-v2-or-v1-only","trusted-input-only","no-untrusted-json-or-xml"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00058,"input_tokens":3159,"output_tokens":528,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':20A,28A,31A '-59168':21A,32A '-6549':29A '/tomwright/dasel':18A,35A '/tomwright/dasel/v2':38A '/tomwright/dasel/v3':41A '3.0.0':119C '3.11.1':121C,206C '85pq':26A 'attack':84B,143C 'attacker-control':142C 'attacker-suppli':83B 'cannot':196C 'caus':9A 'cli':42B 'command':53B,106C,156C 'command-lin':52B,105C,155C 'control':144C 'cqxr':24A 'crash':92B 'cve':19A,30A 'dasel':1A,43B,49B,102C 'data':66B,116C,153C 'decodearray':126C 'decodeobject':124C 'decodevalu':123C 'deepli':81B,140C 'defer':193C 'denial':99B 'depth':79B,138C,190C 'dos':14A 'entir':179C 'error':175C 'exhaust':87B,165C,191C 'failur':199C 'fatal':174C 'fix':203C 'function':163C 'ghsa':23A 'ghsa-cqxr-jxr2-85pq':22A 'github.com':17A,34A,37A,40A 'github.com/tomwright/dasel':16A,33A 'github.com/tomwright/dasel/v2':36A 'github.com/tomwright/dasel/v3':39A 'go':27A,44B,51B,167C 'goroutin':89B,168C 'guard':139C 'host':48B 'input':86B,133C,184C 'input-s':183C 'intercept':197C 'interfac':158C 'issu':201C 'json':5A,62B,74B,145C 'jxr2':25A 'level':71B,135C 'librari':57B,110C 'limit':80B,186C 'line':54B,107C,157C 'modifi':113C 'nest':70B,82B,134C,141C 'newread':151C 'overflow':13A 'packag':45B 'pars':73B,161C 'parseel':129C 'parsing.format':150C 'parsing/json/json_reader.go':122C 'parsing/xml/reader.go':128C 'per':69B,132C 'prevent':189C 'process':95B,180C 'queri':59B,112C 'rais':171C 'read':152C 'reader':8A 'recov':195C 'recurs':3A,67B,130C 'selector':162C 'self':47B 'self-host':46B 'servic':101B 'size':185C 'stack':12A,90B,169C 'stack-overflow':11A 'structur':117C 'suppli':85B,148C 'termin':177C 'tool':55B,108C 'transform':61B,115C 'unbound':2A 'unrecover':10A,173C 'version':205C 'whole':94B 'without':136C 'xml':7A,63B,76B,147C,182C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-21T17:17:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6549","url":"https://pkg.go.dev/vuln/GO-2026-6549","severity":null,"published_at":"2026-10-01T20:23:38+00:00","modified_at":"2026-10-01T20:23:38+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-59168","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-59168","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-59168","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59168","severity":null,"published_at":"2026-09-21T17:17:36+00:00","modified_at":"2026-09-24T21:25:27+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}