{"id":"EUVD-2026-84017","enisaUuid":"bfd74495-aa11-38bc-83d0-b6b1bd75bfc8","description":"Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/json_reader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard. Deeply nested attacker-controlled JSON or XML supplied through parsing.Format(...).NewReader(...).Read(data), the command-line interface, or the parse selector function can exhaust the Go goroutine stack and raise an unrecoverable fatal error that terminates the entire process. The XML input-size limit does not prevent depth exhaustion, and defer or recover cannot intercept the failure. This issue is fixed in version 3.11.1.","datePublished":"Sep 21, 2026, 4:55:07 PM","dateUpdated":"Sep 21, 2026, 8:45:17 PM","baseScore":6.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/TomWright/dasel/security/advisories/GHSA-cqxr-jxr2-85pq\nhttps://github.com/TomWright/dasel/commit/4c91d0d02dc59ce8404709b1bfed7a6fabe62f68\nhttps://github.com/TomWright/dasel/releases/tag/v3.11.1\n","aliases":"CVE-2026-59168\nGHSA-cqxr-jxr2-85pq\n","assigner":"GitHub_M","epss":0.13,"enisaIdProduct":[{"id":"0cb8fde9-e391-3edc-8279-525cd4b582d6","product":{"name":"dasel","vendor":{"name":"TomWright"}},"product_version":"3.0.0, \u003c 3.11.1"}],"enisaIdVendor":[{"id":"630713ac-6fe1-32e5-a250-7ad5d6805dc6","vendor":{"name":"TomWright"}}],"enisaIdVulnerability":[{"id":"8b70ccae-2626-34b9-a813-34e21a3bc73b","vulnerability":{"id":"GHSA-cqxr-jxr2-85pq","description":"Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS","datePublished":"Sep 22, 2026, 7:51:07 PM","dateUpdated":"Sep 22, 2026, 7:51:07 PM","baseScore":0.0,"references":"https://github.com/TomWright/dasel/security/advisories/GHSA-cqxr-jxr2-85pq\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59168\nhttps://github.com/TomWright/dasel/commit/4c91d0d02dc59ce8404709b1bfed7a6fabe62f68\nhttps://github.com/TomWright/dasel\nhttps://github.com/TomWright/dasel/releases/tag/v3.11.1\n","enisa_id":"EUVD-2026-84017\n","aliases":"GHSA-cqxr-jxr2-85pq\nCVE-2026-59168\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:53:48 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"8e1eef96-2bf8-377d-b486-5839e42e74e2","vulnerability":{"id":"CVE-2026-59168","description":"Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/json_reader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard. Deeply nested attacker-controlled JSON or XML supplied through parsing.Format(...).NewReader(...).Read(data), the command-line interface, or the parse selector function can exhaust the Go goroutine stack and raise an unrecoverable fatal error that terminates the entire process. The XML input-size limit does not prevent depth exhaustion, and defer or recover cannot intercept the failure. This issue is fixed in version 3.11.1.","datePublished":"Sep 21, 2026, 4:55:07 PM","dateUpdated":"Sep 21, 2026, 8:45:17 PM","status":"PUBLISHED","baseScore":6.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/TomWright/dasel/security/advisories/GHSA-cqxr-jxr2-85pq\nhttps://github.com/TomWright/dasel/commit/4c91d0d02dc59ce8404709b1bfed7a6fabe62f68\nhttps://github.com/TomWright/dasel/releases/tag/v3.11.1\n","enisa_id":"EUVD-2026-84017\n","assigner":"GitHub_M","epss":0.13,"dataProcessed":"Nov 9, 2026, 3:07:47 PM","vulnerabilityProduct":[{"id":"684eaa1e-6a99-3fbf-b0ca-f960c156c47e","product":{"name":"dasel","vendor":{"name":"TomWright"}},"product_version":"3.0.0, \u003c 3.11.1"}],"vulnerabilityVendor":[{"id":"88f9de4e-10f1-37ba-8380-675b12c804b7","vendor":{"name":"TomWright"}}]}}],"enisaIdAdvisory":[]}