TI-2026-42329 Aliases CVE-2026-59168 GHSA-cqxr-jxr2-85pq

Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS

LOW 27CWE-674Published 2026-09-21 · Updated 2026-09-21

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-674.

Summary

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/json_reader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard. Deeply nested attacker-controlled JSON or XML supplied through parsing.Format(...).NewReader(...).Read(data), the command-line interface, or the parse selector function can exhaust the Go goroutine stack and raise an unrecoverable fatal error that terminates the entire process. The XML input-size limit does not prevent depth exhaustion, and defer or recover cannot intercept the failure. This issue is fixed in version 3.11.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0013 2nd percentileScored 2026-11-07

Fix Fixed dasel (TomWright): 3.11.1github.com/tomwright/dasel/v3 (Go): 3.11.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TomWright	dasel	3.0.0 to before 3.11.1	3.11.1	Patch available	CNA
—	github.com/tomwright/dasel/v3 (Go)	3.0.0 to before 3.11.1	3.11.1	Patch available	GHSA-cqxr-jxr2-85pq

dasel VendorTomWright Affected 3.0.0 to before 3.11.1 Fixed in 3.11.1 Patch available CNA
github.com/tomwright/dasel/v3 (Go) Vendor— Affected 3.0.0 to before 3.11.1 Fixed in 3.11.1 Patch available GHSA-cqxr-jxr2-85pq

Remediation

Fix · CNA dasel (TomWright) Fixed in 3.11.1
Fix · GHSA-cqxr-jxr2-85pq github.com/tomwright/dasel/v3 (Go) Fixed in 3.11.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-59168
2026-10-03 Alias added: GHSA-cqxr-jxr2-85pq

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-59168

Other 4

TI-2026-44930 Dasel: Selector lexer panics on trailing whitespace in `parseCurRune` CVSS 3.1MEDIUM 6.2
TI-2026-34094 Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal CVSS 3.1MEDIUM 6.2
TI-2026-34093 Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string CVSS 3.1MEDIUM 6.2
TI-2026-25731 Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service CVSS 3.1MEDIUM 6.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences