Vulnerability in github.com/tomwright/dasel/v3 (CVE-2026-59168)
Summary
Vulnerability in github.com/tomwright/dasel/v3 (CVE-2026-59168). Risk of unauthorized operations or information disclosure. Exploitable via dasel. Mitigation: upgrade to 3.11.1 or later.
Original description
The description as published by the source.
Summary
dasel's JSON and XML readers parse nested structures with unbounded recursion, one
native stack frame per nesting level, with no depth guard. A small (sub-10 MB), deeply
nested document drives the Go runtime past its goroutine stack limit and triggers a
fatal error: stack overflow. This is unrecoverable: it is a runtime fatal error, not
a panic, so a consumer's defer/recover cannot intercept it, the entire process dies.
Both readers are affected; neither has a depth limit, and the JSON reader additionally has
no input-size cap (the XML reader caps size at 10 MB but not depth).
Affected Versions
github.com/tomwright/dasel/v3 and all v3.x releases through v3.11.0 (current main,
commit abc1e1d). This vulnerability is fixed in 3.11.1. Pre-v3 is out of scope.
Description
JSON reader @ parsing/json/json_reader.go
decodeValue (line 54) dispatches to the mutually-recursive decodeObject (line 78) and
decodeArray (line 140). Each calls back into both for nested values
(decodeArray→decodeArray at line 151, decodeObject at 163; decodeObject→decodeArray
at 95, decodeObject at 111). Every [ or { in the input adds one stack frame. There is
no depth counter and no len(data) cap anywhere in the reader.
XML reader @parsing/xml/reader.go
parseElement (line 172) recurses at line 211 for every xml.StartElement. The file
declares explicit DoS guards — maxXMLSize = 10_000_000, comment count/length — but…
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-59168 has been found in github.com/tomwright/dasel/v3.
Attackers can target a specific entry point like dasel over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 6.2/10.
What to do: upgrade github.com/tomwright/dasel/v3 to 3.11.1 or later.
If unsure, ask your IT team or search "github.com/tomwright/dasel/v3 CVE-2026-59168" on the vendor's site.
CVE-2026-59168 (github.com/tomwright/dasel/v3) — CWE-674 / CVSS v3 6.2
Attack vector: local / unauthenticated / no user interaction
Attack surface: dasel / panic / defer / recover
Patched: 3.11.1 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-674) exists in github.com/tomwright/dasel/v3. Attackers reach the vulnerable code path via dasel without authentication.
Check the vendor advisory for the affected versions of github.com/tomwright/dasel/v3. Attack surface: dasel / panic / defer / recover.
Severity: Medium (CVSS 6.2/10). Risk of unauthorized operations or information disclosure.
Update to 3.11.1.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'github.com/tomwright/dasel/v3' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'github.com/tomwright/dasel/v3' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
github.com/tomwright/dasel/v3を grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade github.com/tomwright/dasel/v3 to 3.11.1ステージング環境で 3.11.1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-59168 dasel Fixed in: 3.11.2-1
- Ubuntu UBUNTU-CVE-2026-59168 dasel
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com
- web github.com