Description

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/json_reader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard. Deeply nested attacker-controlled JSON or XML supplied through parsing.Format(...).NewReader(...).Read(data), the command-line interface, or the parse selector function can exhaust the Go goroutine stack and raise an unrecoverable fatal error that terminates the entire process. The XML input-size limit does not prevent depth exhaustion, and defer or recover cannot intercept the failure. This issue is fixed in version 3.11.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.2",
  "pubDate": "2026-09-21T17:17:36.500Z",
  "pubdate": "2026-09-21T17:17:36.500Z",
  "executiveSummary": "Dasel versions 3.0.0 through 3.11.1 are susceptible to a stack exhaustion vulnerability caused by improper recursion depth management during the parsing of JSON and XML data structures.\nThe vulnerability is classified as a denial-of-service (DoS) condition, where an attacker-supplied deeply nested data structure forces the Go runtime to exhaust the goroutine stack, leading to an unrecoverable fatal error that terminates the process.\nThe flaw affects both the command-line interface and library-level parsing functions. Because the failure is triggered by low-level stack overflow, it cannot be caught or recovered via defer/recover blocks, resulting in immediate application termination.\nThe vulnerability is exploitable by any user capable of supplying malicious input to the parser, requiring no specific authentication or elevated privileges. While XML input-size limits exist, they fail to mitigate this specific depth-based attack vector.\nRisk implications are high for services that process untrusted external data, as this vulnerability allows for trivial service disruption via simple, deeply nested payloads.",
  "technicalDetails": "The root cause of the vulnerability lies in the recursive implementation of data parsing logic within 'parsing/json/json_reader.go' and 'parsing/xml/reader.go'.\nSpecifically, the functions 'decodeValue', 'decodeObject', and 'decodeArray' in the JSON reader, and 'parseElement' in the XML reader, lack necessary depth guards or recursion limits.\nWhen Dasel processes input via 'parsing.Format(...).NewReader(...).Read(data)', each nesting level within the input initiates a new stack frame for these recursive calls. Because the Go runtime assigns a finite amount of stack space to each goroutine, an attacker can construct a pathological payload with excessive nesting depth.\nAs the parser descends through these deeply nested structures, the call stack grows linearly with the depth of the nesting. Once the stack space is exceeded, the Go runtime triggers a fatal error (stack overflow). Unlike standard runtime panics, stack overflow exceptions cannot be intercepted by 'recover()', ensuring a complete and unrecoverable termination of the affected process.\nThe attack flow proceeds as follows: 1) The attacker crafts a valid but deeply nested JSON or XML object. 2) The attacker submits this payload via the Dasel CLI or a function utilizing the library. 3) The parser initiates recursive parsing, allocating new stack frames for each object or array level. 4) The stack memory reaches its limit, causing a runtime fatal error. 5) The process exits abruptly, achieving a denial-of-service.\nThe vulnerability is present in versions 3.0.0 up to, but not including, 3.11.1. It is not limited to specific network configurations; any environment executing Dasel on untrusted input is vulnerable regardless of authentication status, as the processing logic resides in the core parsing layer."
}