CVE-2026-59168

6.2 MEDIUMpublic exploit available

Published 2026-09-21 · Updated 2026-09-21

AI risk analysis

Summary: The flaw allows deep nesting of JSON or XML data to exhaust the Go goroutine stack, leading to a fatal error. This matters because it can cause service disruption without proper mitigation.
Exploitability: Exploitation requires sending deeply nested attacker-controlled JSON/XML data; preconditions include vulnerable Dasel versions in use.
Blast radius: If exploited, this could lead to service downtime and potential denial of service for affected systems.
Prioritized remediation: Update Dasel to version 3.11.1 or later to mitigate the risk.

dosxmljsonstack-exhaustion

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/json_reader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard. Deeply nested attacker-controlled JSON or XML supplied through parsing.Format(...).NewReader(...).Read(data), the command-line interface, or the parse selector function can exhaust the Go goroutine stack and raise an unrecoverable fatal error that terminates the entire process. The XML input-size limit does not prevent depth exhaustion, and defer or recover cannot intercept the failure. This issue is fixed in version 3.11.1.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-674

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.