Vulnerability-Lookup

GHSA-CQXR-JXR2-85PQ

Vulnerability from github – Published: 2026-09-22 19:51 – Updated: 2026-09-22 19:51

Summary

Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS

Details

Summary

dasel's JSON and XML readers parse nested structures with unbounded recursion, one native stack frame per nesting level, with no depth guard. A small (sub-10 MB), deeply nested document drives the Go runtime past its goroutine stack limit and triggers a fatal error: stack overflow. This is unrecoverable: it is a runtime fatal error, not a panic, so a consumer's defer/recover cannot intercept it, the entire process dies.

Both readers are affected; neither has a depth limit, and the JSON reader additionally has no input-size cap (the XML reader caps size at 10 MB but not depth).

Affected Versions

github.com/tomwright/dasel/v3 and all v3.x releases through v3.11.0 (current main, commit abc1e1d). This vulnerability is fixed in 3.11.1. Pre-v3 is out of scope.

Description

JSON reader @ `parsing/json/json_reader.go`

decodeValue (line 54) dispatches to the mutually-recursive decodeObject (line 78) and decodeArray (line 140). Each calls back into both for nested values (decodeArray→decodeArray at line 151, decodeObject at 163; decodeObject→decodeArray at 95, decodeObject at 111). Every [ or { in the input adds one stack frame. There is no depth counter and no len(data) cap anywhere in the reader.

XML reader @`parsing/xml/reader.go`

parseElement (line 172) recurses at line 211 for every xml.StartElement. The file declares explicit DoS guards — maxXMLSize = 10_000_000, comment count/length — but these bound size and comment volume, not nesting depth. The open tag <a> is 3 bytes, so the 10 MB cap still permits ~3.3 M nesting levels, exhausting the stack long before the size limit fires.

Reachability (both)

Both are on the primary public read path: parsing.Format(<fmt>).NewReader(opts).Read(data), with data fully attacker-controlled and no depth validation before the recursion. The same path backs the dasel CLI (dasel -r json / -r xml). Default reader, no special options. Go stack overflow is a fatal error, so recover() at the call site does not help.

Precedent in this codebase

DoS hardening on the readers is already an accepted concern here, which is why this is a gap rather than a design choice: the XML reader has the maxXMLSize cap, and the YAML reader already implements exactly the fix needed, parsing/yaml/yaml_reader.go:31,90-93 returns ErrYamlExpansionDepthExceeded once expansionDepth > maxExpansionDepth. The JSON and XML readers simply lack the equivalent depth guard.

Proof of Concept

Single runnable program, public API only (poc/main.go, module wired to a local clone via replace):

package main

import (
    "fmt"; "os"; "strings"
    "github.com/tomwright/dasel/v3/parsing"
    _ "github.com/tomwright/dasel/v3/parsing/json"
    _ "github.com/tomwright/dasel/v3/parsing/xml"
)

func main() {
    mode := "json"; if len(os.Args) > 1 { mode = os.Args[1] }
    depth := 6_000_000; if mode == "xml" { depth = 3_200_000 }

    var data []byte
    if mode == "xml" {
        data = []byte(strings.Repeat("<a>", depth))          // ~9.6MB, under the 10MB cap
    } else {
        data = []byte(strings.Repeat("[", depth) + strings.Repeat("]", depth)) // ~12MB
    }

    defer func() { if r := recover(); r != nil { fmt.Println("recovered (NOT fatal):", r) } }()
    r, _ := parsing.Format(mode).NewReader(parsing.DefaultReaderOptions())
    v, err := r.Read(data)
    fmt.Printf("Read returned WITHOUT crash: v=%v err=%v\n", v != nil, err)
}

go run . json    # nested arrays -> fatal error: stack overflow ; ~85 decodeArray frames
go run . xml     # nested <a>    -> fatal error: stack overflow ; ~93 parseElement frames

Observed (Go 1.26, default 1 GB goroutine stack): - json depth 6 M (12 MB): runtime: goroutine stack exceeds 1000000000-byte limit → fatal error: stack overflow; backtrace dominated by json.(*jsonReader).decodeArray. depth 2 M completes (~0.83 s), confirming it is depth-driven, not a parse error. - xml depth 3.2 M (9.6 MB, under the 10 MB maxXMLSize cap): same fatal overflow; backtrace is an unbroken chain of xml.(*xmlReader).parseElement at reader.go:211. - The deferred recover() never fires in either case — the process exits. - CLI equivalents: printf '<a>%.0s' {1..3200000} | dasel -r xml.

Impact

An attacker who controls JSON or XML passed to dasel — via the library Read API, the CLI, or the parse('json'|'xml', …) selector function — crashes the host process with a single small document. Because the failure is a Go fatal error rather than a recoverable panic, a consumer that wraps parsing in defer/recover is still taken down: the whole process terminates, killing every in-flight goroutine, not just the parse. Availability only — no confidentiality or integrity impact. For a library consumer feeding network-sourced data to Read, this is a remotely triggerable, unrecoverable DoS.

Suggested Fix

Add a recursion-depth guard to both readers, mirroring the YAML reader's existing maxExpansionDepth / ErrYamlExpansionDepthExceeded pattern:

JSON — thread a depth int through decodeValue/decodeObject/decodeArray, increment on descent, return ErrJSONMaxDepthExceeded past a conservative bound (e.g. 10 000). Optionally add a maxJSONSize cap matching maxXMLSize for parity.
XML — add a maxXMLDepth constant to the existing Security limits block and thread a depth through parseElement, returning a normal error past the bound.

Both return a clean error for pathological input instead of crashing the process, consistent with how the comment-count, size, and YAML-expansion limits already behave. A limit in the low thousands preserves all realistic legitimate documents.

Severity

6.2 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.11.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/tomwright/dasel/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.11.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59168"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-22T19:51:07Z",
    "nvd_published_at": "2026-09-21T17:17:36Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n`dasel`\u0027s JSON and XML readers parse nested structures with unbounded recursion, one\nnative stack frame per nesting level, with no depth guard. A small (sub-10 MB), deeply\nnested document drives the Go runtime past its goroutine stack limit and triggers a\n`fatal error: stack overflow`. This is **unrecoverable**: it is a runtime fatal error, not\na `panic`, so a consumer\u0027s `defer`/`recover` cannot intercept it, the entire process dies.\n\nBoth readers are affected; neither has a depth limit, and the JSON reader additionally has\nno input-size cap (the XML reader caps size at 10 MB but not depth).\n\n## Affected Versions\n\n`github.com/tomwright/dasel/v3` and all v3.x releases through **v3.11.0** (current `main`,\ncommit `abc1e1d`). This vulnerability is fixed in 3.11.1. Pre-v3 is out of scope.\n\n## Description\n\n### JSON reader @ `parsing/json/json_reader.go`\n\n`decodeValue` (line 54) dispatches to the mutually-recursive `decodeObject` (line 78) and\n`decodeArray` (line 140). Each calls back into both for nested values\n(`decodeArray`\u2192`decodeArray` at line 151, `decodeObject` at 163; `decodeObject`\u2192`decodeArray`\nat 95, `decodeObject` at 111). Every `[` or `{` in the input adds one stack frame. There is\n**no depth counter and no `len(data)` cap** anywhere in the reader.\n\n### XML reader @`parsing/xml/reader.go`\n\n`parseElement` (line 172) recurses at line 211 for every `xml.StartElement`. The file\ndeclares explicit DoS guards \u2014 `maxXMLSize = 10_000_000`, comment count/length \u2014 but these\nbound **size and comment volume, not nesting depth**. The open tag `\u003ca\u003e` is 3 bytes, so the\n10 MB cap still permits ~3.3 M nesting levels, exhausting the stack long before the size\nlimit fires.\n\n### Reachability (both)\n\nBoth are on the primary public read path: `parsing.Format(\u003cfmt\u003e).NewReader(opts).Read(data)`,\nwith `data` fully attacker-controlled and no depth validation before the recursion. The same\npath backs the `dasel` CLI (`dasel -r json` / `-r xml`). Default reader, no special options.\nGo stack overflow is a `fatal error`, so `recover()` at the call site does not help.\n\n### Precedent in this codebase\n\nDoS hardening on the readers is already an accepted concern here, which is why this is a gap\nrather than a design choice: the XML reader has the `maxXMLSize` cap, and the **YAML reader\nalready implements exactly the fix needed**, `parsing/yaml/yaml_reader.go:31,90-93` returns\n`ErrYamlExpansionDepthExceeded` once `expansionDepth \u003e maxExpansionDepth`. The JSON and XML\nreaders simply lack the equivalent depth guard.\n\n## Proof of Concept\n\nSingle runnable program, public API only (`poc/main.go`, module wired to a local clone via\n`replace`):\n\n```go\npackage main\n\nimport (\n\t\"fmt\"; \"os\"; \"strings\"\n\t\"github.com/tomwright/dasel/v3/parsing\"\n\t_ \"github.com/tomwright/dasel/v3/parsing/json\"\n\t_ \"github.com/tomwright/dasel/v3/parsing/xml\"\n)\n\nfunc main() {\n\tmode := \"json\"; if len(os.Args) \u003e 1 { mode = os.Args[1] }\n\tdepth := 6_000_000; if mode == \"xml\" { depth = 3_200_000 }\n\n\tvar data []byte\n\tif mode == \"xml\" {\n\t\tdata = []byte(strings.Repeat(\"\u003ca\u003e\", depth))          // ~9.6MB, under the 10MB cap\n\t} else {\n\t\tdata = []byte(strings.Repeat(\"[\", depth) + strings.Repeat(\"]\", depth)) // ~12MB\n\t}\n\n\tdefer func() { if r := recover(); r != nil { fmt.Println(\"recovered (NOT fatal):\", r) } }()\n\tr, _ := parsing.Format(mode).NewReader(parsing.DefaultReaderOptions())\n\tv, err := r.Read(data)\n\tfmt.Printf(\"Read returned WITHOUT crash: v=%v err=%v\\n\", v != nil, err)\n}\n```\n\n```\ngo run . json    # nested arrays -\u003e fatal error: stack overflow ; ~85 decodeArray frames\ngo run . xml     # nested \u003ca\u003e    -\u003e fatal error: stack overflow ; ~93 parseElement frames\n```\n\nObserved (Go 1.26, default 1 GB goroutine stack):\n- `json` depth 6 M (12 MB): `runtime: goroutine stack exceeds 1000000000-byte limit` \u2192\n  `fatal error: stack overflow`; backtrace dominated by `json.(*jsonReader).decodeArray`.\n  `depth 2 M` completes (~0.83 s), confirming it is depth-driven, not a parse error.\n- `xml` depth 3.2 M (9.6 MB, **under** the 10 MB `maxXMLSize` cap): same fatal overflow;\n  backtrace is an unbroken chain of `xml.(*xmlReader).parseElement` at `reader.go:211`.\n- The deferred `recover()` never fires in either case \u2014 the process exits.\n- CLI equivalents: `printf \u0027\u003ca\u003e%.0s\u0027 {1..3200000} | dasel -r xml`.\n\n## Impact\n\nAn attacker who controls JSON or XML passed to dasel \u2014 via the library `Read` API, the CLI,\nor the `parse(\u0027json\u0027|\u0027xml\u0027, \u2026)` selector function \u2014 crashes the host process with a single\nsmall document. Because the failure is a Go `fatal error` rather than a recoverable panic, a\nconsumer that wraps parsing in `defer`/`recover` is **still** taken down: the whole process\nterminates, killing every in-flight goroutine, not just the parse. Availability only \u2014 no\nconfidentiality or integrity impact. For a library consumer feeding network-sourced data to\n`Read`, this is a remotely triggerable, unrecoverable DoS.\n\n## Suggested Fix\n\nAdd a recursion-depth guard to both readers, mirroring the YAML reader\u0027s existing\n`maxExpansionDepth` / `ErrYamlExpansionDepthExceeded` pattern:\n\n- **JSON** \u2014 thread a `depth int` through `decodeValue`/`decodeObject`/`decodeArray`,\n  increment on descent, return `ErrJSONMaxDepthExceeded` past a conservative bound\n  (e.g. 10 000). Optionally add a `maxJSONSize` cap matching `maxXMLSize` for parity.\n- **XML** \u2014 add a `maxXMLDepth` constant to the existing `Security limits` block and thread\n  a `depth` through `parseElement`, returning a normal error past the bound.\n\nBoth return a clean `error` for pathological input instead of crashing the process,\nconsistent with how the comment-count, size, and YAML-expansion limits already behave. A\nlimit in the low thousands preserves all realistic legitimate documents.",
  "id": "GHSA-cqxr-jxr2-85pq",
  "modified": "2026-09-22T19:51:07Z",
  "published": "2026-09-22T19:51:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/TomWright/dasel/security/advisories/GHSA-cqxr-jxr2-85pq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59168"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TomWright/dasel/commit/4c91d0d02dc59ce8404709b1bfed7a6fabe62f68"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/TomWright/dasel"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TomWright/dasel/releases/tag/v3.11.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS"
}

CVE-2026-59168 (GCVE-0-2026-59168)

Vulnerability from cvelistv5 – Published: 2026-09-21 16:55 – Updated: 2026-09-21 20:45

Title

Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS

Summary

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/json_reader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard. Deeply nested attacker-controlled JSON or XML supplied through parsing.Format(...).NewReader(...).Read(data), the command-line interface, or the parse selector function can exhaust the Go goroutine stack and raise an unrecoverable fatal error that terminates the entire process. The XML input-size limit does not prevent depth exhaustion, and defer or recover cannot intercept the failure. This issue is fixed in version 3.11.1.

Severity

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-21 19:40 UTC

CWE

CWE-674 - Uncontrolled Recursion

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/TomWright/dasel/security/advis…	x_refsource_CONFIRM
https://github.com/TomWright/dasel/commit/4c91d0d…	x_refsource_MISC
https://github.com/TomWright/dasel/releases/tag/v3.11.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
TomWright	dasel	Affected: >= 3.0.0, < 3.11.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59168",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T19:40:35.532900Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T20:45:17.805Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dasel",
          "vendor": "TomWright",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.11.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/json_reader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard. Deeply nested attacker-controlled JSON or XML supplied through parsing.Format(...).NewReader(...).Read(data), the command-line interface, or the parse selector function can exhaust the Go goroutine stack and raise an unrecoverable fatal error that terminates the entire process. The XML input-size limit does not prevent depth exhaustion, and defer or recover cannot intercept the failure. This issue is fixed in version 3.11.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T16:55:07.859Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/TomWright/dasel/security/advisories/GHSA-cqxr-jxr2-85pq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/TomWright/dasel/security/advisories/GHSA-cqxr-jxr2-85pq"
        },
        {
          "name": "https://github.com/TomWright/dasel/commit/4c91d0d02dc59ce8404709b1bfed7a6fabe62f68",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/TomWright/dasel/commit/4c91d0d02dc59ce8404709b1bfed7a6fabe62f68"
        },
        {
          "name": "https://github.com/TomWright/dasel/releases/tag/v3.11.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/TomWright/dasel/releases/tag/v3.11.1"
        }
      ],
      "source": {
        "advisory": "GHSA-cqxr-jxr2-85pq",
        "discovery": "UNKNOWN"
      },
      "title": "Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59168",
    "datePublished": "2026-09-21T16:55:07.859Z",
    "dateReserved": "2026-07-02T16:50:27.887Z",
    "dateUpdated": "2026-09-21T20:45:17.805Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-CQXR-JXR2-85PQ

Summary

Affected Versions

Description

JSON reader @ parsing/json/json_reader.go

XML reader @parsing/xml/reader.go

Reachability (both)

Precedent in this codebase

Proof of Concept

Impact

Suggested Fix

CVE-2026-59168 (GCVE-0-2026-59168)

Tags

Sightings

Nomenclature

Related by attack behaviour

JSON reader @ `parsing/json/json_reader.go`

XML reader @`parsing/xml/reader.go`