CVE-2026-59168
Received Received - Intake

Stack Overflow in Dasel JSON/XML Parser

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/json_reader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard. Deeply nested attacker-controlled JSON or XML supplied through parsing.Format(...).NewReader(...).Read(data), the command-line interface, or the parse selector function can exhaust the Go goroutine stack and raise an unrecoverable fatal error that terminates the entire process. The XML input-size limit does not prevent depth exhaustion, and defer or recover cannot intercept the failure. This issue is fixed in version 3.11.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-59168
EUVD
EUVD-2026-84017

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tomwright dasel to 3.11.0 (inc)
tomwright dasel 3.11.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-59168 is a stack overflow vulnerability in the dasel library versions 3.0.0 to 3.11.0. It occurs when parsing deeply nested JSON or XML input without depth limits, causing the Go runtime to exceed the goroutine stack limit. This leads to a fatal error that crashes the entire process and cannot be recovered from using defer/recover mechanisms.

Detection Guidance

To detect this vulnerability, monitor for crashes in applications using dasel versions 3.0.0 to 3.11.0 when processing deeply nested JSON or XML. Check logs for fatal errors like 'stack overflow' or 'goroutine stack exceeded'. Use commands like 'dasel --version' to verify installed versions. If crashes occur during parsing, it may indicate exploitation.

Impact Analysis

An attacker can exploit this by providing a small but deeply nested document, causing a denial-of-service (DoS) condition. This crashes the host process using the dasel library, including its CLI, Read API, or selector functions. The impact is a complete termination of the affected application.

Compliance Impact

This vulnerability primarily causes a denial-of-service (DoS) condition by crashing the host process through stack overflow, which does not directly impact data confidentiality or integrity. However, it could indirectly affect compliance by disrupting availability of systems relying on dasel for data processing, potentially violating service-level agreements or operational requirements in GDPR or HIPAA.

Mitigation Strategies

Upgrade dasel to version 3.11.1 or later, which includes depth guards to prevent stack overflows. If upgrading is not possible, restrict input to trusted sources and limit nesting depth in JSON/XML documents. Monitor for crashes and apply input validation to detect deeply nested structures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59168. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart