# CVE-2026-59168: Dasel unbounded recursion in JSON and XML readers causes stack overflow DoS

Source: https://junglewise.ai/threats/cve-2026-59168-dasel-unbounded-recursion-in-json-and-xml-readers-causes-stack  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-59168 · Severity: medium · CVSS 6.2 · Published 2026-09-21

Dasel is a library and CLI tool for querying and manipulating JSON and XML data. A flaw in how deeply nested documents are parsed allows attackers to crash the entire host process using a small malicious document (sub-10 MB), resulting in complete service unavailability with no way to recover gracefully.

Technologies: [github.com/tomwright/dasel (Go)](https://junglewise.ai/threats/technologies/github-com-tomwright-dasel), [github.com/tomwright/dasel/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-tomwright-dasel-v2), [github.com/tomwright/dasel/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-tomwright-dasel-v3), [TomWright Dasel](https://junglewise.ai/threats/technologies/dasel). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [TomWright](https://junglewise.ai/threats/vendors/tomwright).

## Quick answers

**Is CVE-2026-59168 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59168 being exploited in the wild.

**How severe is CVE-2026-59168?** Medium severity, with a CVSS score of 6.2, published 21 September 2026.

**Which products and versions are affected?** github.com/tomwright/dasel (Go) SEMVER:introduced=0; github.com/tomwright/dasel/v2 (Go) SEMVER:introduced=0; github.com/tomwright/dasel/v3 (Go) >= 3.0.0, <= 3.11.0, SEMVER:introduced=3.0.0,fixed=3.11.1; TomWright Dasel v3.0.0 through v3.11.0.

**Is there a fix for CVE-2026-59168?** Yes. github.com/tomwright/dasel/v3 (Go): upgrade to 3.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59168 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-59168?** Check whether you run github.com/tomwright/dasel (Go), github.com/tomwright/dasel/v2 (Go), github.com/tomwright/dasel/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/tomwright/dasel/v3 (Go): upgrade to 3.11.1 or later

  ```sh
  go get github.com/tomwright/dasel/v3@v3.11.1
  ```


## Technical details

The JSON and XML readers in Dasel use unbounded recursion to parse nested structures, with one native stack frame per nesting level and no depth validation. The JSON reader (in `decodeValue`, `decodeObject`, `decodeArray`) has no depth limit or input-size cap; the XML reader has a 10 MB size cap but no depth bound. Both are reachable via the public API (`parsing.Format().NewReader().Read(data)`) with fully attacker-controlled input. An attacker can trigger a Go runtime `fatal error: stack overflow` by providing deeply nested input (e.g., 6M nested array brackets for JSON, 3.2M nested XML tags), which terminates the process unrecoverably—Go fatal errors are not panics, so a consumer's `defer`/`recover()` cannot catch them. The YAML reader in the same codebase already implements the correct fix (a `maxExpansionDepth` guard returning a clean error), but JSON and XML readers lack this protection.

## Affected products

- tomwright dasel v3.0.0 through v3.11.0

## Identifiers

- CVE-2026-59168
- GHSA-cqxr-jxr2-85pq
- GO-2026-6549

## Timeline

- 2026-09-22: disclosed: CVE-2026-59168 published
- 2026-09-22: patched: Fix available in v3.11.1

## Related threats

- [Dasel selector lexer panic on trailing whitespace](https://junglewise.ai/threats/cve-2026-62866-dasel-selector-lexer-panic-on-trailing-whitespace)
- [TomWright Dasel infinite loop in selector lexer](https://junglewise.ai/threats/cve-2026-46378-tomwright-dasel-infinite-loop-in-selector-lexer)
- [TomWright Dasel index out of bounds panic in selector lexer](https://junglewise.ai/threats/cve-2026-46377-tomwright-dasel-index-out-of-bounds-panic-in-selector-lexer)
- [Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service](https://junglewise.ai/threats/cve-2026-33320-dasel-has-unbounded-yaml-alias-expansion-in-dasel-leads-to-cpu)