CVE-2026-59168: Dasel Data Query Tool DOS Vulnerability

CVE-2026-59168 Overview

Dasel is a command-line tool and Go library for querying, modifying, and transforming structured data formats. Versions from 3.0.0 through 3.11.0 contain an uncontrolled recursion flaw [CWE-674] in the JSON and XML parsers. The decodeValue, decodeObject, and decodeArray functions in parsing/json/json_reader.go and parseElement in parsing/xml/reader.go recurse once per nesting level without any depth guard. Attackers can craft deeply nested input that exhausts the Go goroutine stack and triggers an unrecoverable fatal error. The version 3.11.1 release resolves the issue.

Critical Impact
A single malicious JSON or XML payload processed by Dasel terminates the entire host process, and Go's defer or recover cannot intercept the stack-exhaustion fatal error.

Affected Products

Dasel command-line tool, versions 3.0.0 through 3.11.0
Dasel Go library (github.com/tomwright/dasel/v3), versions 3.0.0 through 3.11.0
Any application invoking parsing.Format(...).NewReader(...).Read(data) or the parse selector function on untrusted input

Discovery Timeline

2026-09-21 - CVE-2026-59168 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-59168

Vulnerability Analysis

Dasel's JSON reader parses input by mutually recursing between decodeValue, decodeObject, and decodeArray. Each nested object or array consumes an additional Go stack frame. The XML reader follows the same pattern in parseElement, recursing once per nested element. Neither parser tracks nesting depth or enforces a bound before descending. When an attacker submits input with tens of thousands of nested containers, the goroutine stack grows past its runtime limit and Go raises runtime: goroutine stack exceeds limit. This is a fatal error rather than a Go panic, so wrapper code cannot recover the process.

Root Cause

The root cause is missing depth accounting in both parsers. The XML reader enforced a 10MB input-size cap through maxXMLSize, but byte-size limits do not constrain nesting depth. A payload of only a few kilobytes can express nesting sufficient to exhaust the stack. The fix introduces maxJSONDepth = 10_000 and maxXMLDepth = 10_000 constants and returns ErrJSONMaxDepthExceeded or ErrXMLMaxDepthExceeded before recursion overflows.

Attack Vector

Exploitation requires that Dasel process attacker-controlled input. The attack vector is local: an operator running dasel against a malicious file, a service invoking the library on untrusted data, or a pipeline consuming user-supplied JSON or XML. Successful exploitation crashes the entire process, causing denial of service for any workload sharing the goroutine.

// Patch: parsing/json/json_reader.go
import (
    "bytes"
    "errors"
    "fmt"
    json "github.com/goccy/go-json"
    "github.com/tomwright/dasel/v3/model"
    "github.com/tomwright/dasel/v3/parsing"
    "strings"
)

// ErrJSONMaxDepthExceeded is returned when JSON nesting depth exceeds maxJSONDepth.
var ErrJSONMaxDepthExceeded = errors.New("json nesting depth exceeded")

const maxJSONDepth = 10_000

Source: GitHub commit 4c91d0d

// Patch: parsing/xml/reader.go
maxCommentLength = 10_000     // Maximum bytes per comment (10KB)
maxTotalComments = 1_000      // Maximum comments per document
maxXMLSize       = 10_000_000 // Maximum XML input size (10MB)
maxXMLDepth      = 10_000     // Maximum element nesting depth - prevents stack overflow

// ErrXMLMaxDepthExceeded is returned when XML nesting depth exceeds maxXMLDepth.
var ErrXMLMaxDepthExceeded = errors.New("xml nesting depth exceeded")

Source: GitHub commit 4c91d0d

Detection Methods for CVE-2026-59168

Indicators of Compromise

Sudden process termination of dasel or any Go binary linking github.com/tomwright/dasel/v3 with the runtime message runtime: goroutine stack exceeds.
JSON or XML input files containing thousands of unclosed opening tokens such as [[[[... or <a><a><a>....
Repeated crash-restart cycles in services that pipe user-controlled configuration or telemetry through Dasel.

Detection Strategies

Inventory Go binaries and CI pipelines for the github.com/tomwright/dasel/v3 module at versions 3.0.0 through 3.11.0.
Instrument wrappers around Dasel invocations to capture stderr and exit status, since the fatal error bypasses recover.
Add pre-parse validation that rejects payloads whose brace, bracket, or element counts exceed a documented depth threshold.

Monitoring Recommendations

Alert on non-zero exit codes and SIGABRT from processes invoking dasel.
Log input sizes and structural metrics for JSON and XML consumed by Dasel-based tools.
Track dependency graphs in build systems to identify indirect use of the vulnerable library.

How to Mitigate CVE-2026-59168

Immediate Actions Required

Upgrade Dasel and any Go application vendoring github.com/tomwright/dasel/v3 to version 3.11.1 or later.
Audit automation, CI/CD jobs, and services that pass untrusted JSON or XML to Dasel and restrict their input sources.
Isolate Dasel invocations in short-lived subprocesses so a fatal error does not terminate a long-running parent service.

Patch Information

The fix is available in Dasel v3.11.1. The patch introduces maxJSONDepth and maxXMLDepth constants of 10,000 and returns ErrJSONMaxDepthExceeded or ErrXMLMaxDepthExceeded before recursion can exhaust the stack. Full technical detail is published in GitHub Security Advisory GHSA-cqxr-jxr2-85pq.

Workarounds

Pre-validate input by counting opening tokens and rejecting payloads that exceed a conservative depth budget before passing them to Dasel.
Restrict Dasel to trusted data sources only until the upgrade to 3.11.1 completes.
Run Dasel under a supervisor that automatically restarts the process, since the fatal error cannot be trapped in-process.

bash

# Update the Dasel CLI
go install github.com/tomwright/dasel/v3/cmd/dasel@v3.11.1

# Update the library dependency in a Go project
go get github.com/tomwright/dasel/v3@v3.11.1
go mod tidy

# Verify the installed version
dasel --version