Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

6.2 · CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

• CVE-2026-59168: 0.13% estimated exploitation activity in the next 30 days; percentile 2.68 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary dasel's JSON and XML readers parse nested structures with unbounded recursion, one native stack frame per nesting level, with no depth guard. A small (sub-10 MB), deeply nested document drives the Go runtime past its goroutine stack limit and triggers a fatal error: stack overflow. This is unrecoverable: it is a runtime fatal error, not a panic, so a consumer's defer/recover cannot intercept it, the entire process dies. Both readers are affected; neither has a depth limit, and the JSON reader additionally has no input-size cap (the XML reader caps size at 10 MB but not depth). Affected Versions github.com/tomwright/dasel/v3 and all v3.x releases through v3.11.0 (current main, commit abc1e1d). This vulnerability is fixed in 3.11.1. Pre-v3 is out of scope. Description JSON reader @ parsing/json/jsonreader.go decodeValue (line 54) dispatches to the mutually-recursive decodeObject (line 78) and decodeArray (line 140). Each calls back into both for nested values…

Published by the source

22 Sep 2026, 19:51 UTC

Last modified by the source

1 Oct 2026, 20:45 UTC

Source last checked

26 Oct 2026, 15:29 UTC

1. Revision 3 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-cqxr-jxr2-85pq

2. Revision 2 · amended · 24 Oct 2026

   Amended from osv record GO-2026-6549

3. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-cqxr-jxr2-85pq

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-59168

Advisory: Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS
IDs: CVE-2026-59168, GHSA-cqxr-jxr2-85pq
Record: https://patchnext.com/advisories/cve-2026-59168 (revision 3, source checked 26 Oct 2026, 15:29 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 6.2)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Partial vendor fix; fixed versions by package: github.com/tomwright/dasel/v3 3.11.1. A vendor fix does not mean a deployment is fixed.

## Affected components
- Go github.com/tomwright/dasel: affected every version
- Go github.com/tomwright/dasel/v2: affected every version
- Go github.com/tomwright/dasel/v3: affected >= 3.0.0, <= 3.11.0; fixed in 3.11.1

## Suggested inspection (read-only)
- Go github.com/tomwright/dasel: check the installed version with your package manager.
- Go github.com/tomwright/dasel/v2: check the installed version with your package manager.
- Go github.com/tomwright/dasel/v3: check the installed version with your package manager.

## Supported action
No complete vendor fix is recorded. Follow the primary source's mitigation guidance and check this record again before closing anything.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on github.com/tomwright/dasel, github.com/tomwright/dasel/v2, github.com/tomwright/dasel/v3.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-cqxr-jxr2-85pq (OSV record GHSA-cqxr-jxr2-85pq lists affected ranges: Go github.com/tomwright/dasel/v3 >=3.0.0 <3.11.1 (fixed))
- Verified: https://osv.dev/vulnerability/GO-2026-6549 (OSV record GO-2026-6549 lists affected ranges: Go github.com/tomwright/dasel >=0; Go github.com/tomwright/dasel/v2 >=0; Go github.com/tomwright/dasel/v3 >=3.0.0 <3.11.1 (fixed))
- Verified: https://github.com/advisories/GHSA-cqxr-jxr2-85pq (GitHub-reviewed advisory GHSA-cqxr-jxr2-85pq lists affected ranges: Go github.com/tomwright/dasel/v3 >=3.0.0 <=3.11.0)

Commands are suggestions: review each one before running it.