CVE-2026-59168 json
Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS
published 2026-09-21 48 d ago modified 2026-10-01 38 d ago also EUVD-2026-84017 , GHSA-cqxr-jxr2-85pq , GO-2026-6549
- cvss
- 6.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 2%
- public exploits
- 0
- none known
Summary
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/json_reader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard. Deeply nested attacker-controlled JSON or XML supplied through parsing.Format(...).NewReader(...).Read(data), the command-line interface, or the parse selector function can exhaust the Go goroutine stack and raise an unrecoverable fatal error that terminates the entire process. The XML input-size limit does not prevent depth exhaustion, and defer or recover cannot intercept the failure. This issue is fixed in version 3.11.1.
Patch / fix
- go github.com/tomwright/dasel/v3 3.11.1
- tomwright dasel 3.11.1
- dasel Debian 14 3.11.2-1
debian advisories DEBIAN-CVE-2026-59168
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 48 d ago
Exploit prediction
0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.2 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 6.2 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/tomwright/dasel/v3 | >=3.0.0, <3.11.1 |
3.11.1 |
| go | github.com/tomwright/dasel | all versions |
no fix listed |
| go | github.com/tomwright/dasel/v2 | all versions |
no fix listed |
Affected products
- TomWright dasel
Classification
- Weakness
-
- CWE-674 Uncontrolled Recursion
References
-
github.com
/TomWright/dasel/commit/4c91d0d02dc59ce8404709b1bfed7a6fabe62f68
web
-
github.com
/TomWright/dasel/security/advisories/GHSA-cqxr-jxr2-85pq
web, advisory
-
github.com
/TomWright/dasel/releases/tag/v3.11.1
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-59168
advisory
-
github.com
/TomWright/dasel
package
Sources
- CVE List CVE-2026-59168
- GitHub Advisory GHSA-cqxr-jxr2-85pq
- NVD CVE-2026-59168
- OSV GO-2026-6549
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.