Executive brief
Dasel is a library and CLI tool for querying and manipulating JSON and XML data. A flaw in how deeply nested documents are parsed allows attackers to crash the entire host process using a small malicious document (sub-10 MB), resulting in complete service unavailability with no way to recover gracefully.
Technical details
The JSON and XML readers in Dasel use unbounded recursion to parse nested structures, with one native stack frame per nesting level and no depth validation. The JSON reader (in `decodeValue`, `decodeObject`, `decodeArray`) has no depth limit or input-size cap; the XML reader has a 10 MB size cap but no depth bound. Both are reachable via the public API (`parsing.Format().NewReader().Read(data)`) with fully attacker-controlled input. An attacker can trigger a Go runtime `fatal error: stack overflow` by providing deeply nested input (e.g., 6M nested array brackets for JSON, 3.2M nested XML tags), which terminates the process unrecoverably—Go fatal errors are not panics, so a consumer's `defer`/`recover()` cannot catch them. The YAML reader in the same codebase already implements the correct fix (a `maxExpansionDepth` guard returning a clean error), but JSON and XML readers lack this protection.
Affected products
- tomwright dasel v3.0.0 through v3.11.0
Timeline
- 2026-09-22: disclosed: CVE-2026-59168 published
- 2026-09-22: patched: Fix available in v3.11.1