CVE-2026-59168

Executive Summary

CVE-2026-59168 is an uncontrolled recursion vulnerability (CWE-674) in Dasel, a command-line tool and library for querying, modifying, and transforming data structures. Versions 3.0.0 through 3.11.0 contain recursive JSON and XML decoders that lack depth guards, allowing deeply nested attacker-controlled input to exhaust the Go goroutine stack and trigger an unrecoverable fatal error that terminates the entire process. Any system that parses untrusted JSON or XML through Dasel — whether via the library API, CLI, or parse selector — is exposed to a reliable denial-of-service condition, rated CVSS 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Technical Analysis

The vulnerability resides in two distinct parsers within the Dasel codebase:

1. JSON parser (parsing/json/json_reader.go): The functions decodeValue, decodeObject, and decodeArray recurse once per input nesting level. Each nested JSON object or array adds a new stack frame without any maximum depth check.

2. XML parser (parsing/xml/reader.go): The function parseElement exhibits the same unbounded recursion pattern, recursing for each nested XML element.

In Go, goroutine stacks grow dynamically but have a hard limit (typically 1 GB on 64-bit systems). When that limit is exceeded, the Go runtime raises a fatal error — fatal error: stack overflow — that cannot be intercepted. Critically, the standard defer and recover mechanisms cannot catch this failure because it occurs at the runtime level, not as a panic. The entire process terminates immediately.

The attack surface is broad:

• Library API: Any application calling parsing.Format(...).NewReader(...).Read(data) with untrusted input.
• CLI: Invoking the Dasel command-line tool against attacker-supplied JSON or XML files or streams.
• Parse selector: Using the parse selector function within a Dasel query expression to decode attacker-controlled embedded data.

The XML parser includes an input-size limit, but that limit constrains only total byte count — not nesting depth. An attacker can craft a small XML document (a few kilobytes) with thousands of nested elements, achieving stack exhaustion while staying well under the size threshold. JSON has no analogous size limit at all in the affected code path.

This is a classic uncontrolled recursion / stack exhaustion pattern. The fix in version 3.11.1 introduces depth guards to the recursive decoder functions, bounding recursion to a safe maximum nesting level.

Exploitation Scenarios

No public proof-of-concept exists for CVE-2026-59168. The attack chain below is inferred from the vulnerability class (CWE-674) and the NVD description.

Step 1 — Reconnaissance / Target Identification An attacker identifies a target application or service that uses Dasel version 3.0.0–3.11.0 to parse user-supplied JSON or XML. This includes:

• Web applications accepting JSON/XML uploads or request bodies and passing them through Dasel for transformation.
• CI/CD pipelines that run Dasel against repository files or pipeline artifacts.
• CLI-based data processing workflows where users supply input files.

Step 2 — Triggering the Flaw The attacker crafts a JSON or XML document with an extreme nesting depth — thousands of nested objects, arrays, or XML elements. The payload is delivered through any of the three vectors described in the NVD description:

• The library API: parsing.Format(...).NewReader(...).Read(data)
• The command-line interface
• The parse selector function

Step 3 — Payload Execution (Vulnerability-Class Level) When Dasel begins decoding, each nesting level consumes a stack frame. The recursion proceeds until the Go runtime's stack limit is reached. At that point, the runtime raises a fatal error that no defer/recover block can intercept, and the entire process is terminated. The XML input-size limit does not prevent this because the payload is depth-based, not size-based.

Step 4 — Post-Exploitation Impact The target process crashes. Depending on the deployment:

• A web service becomes unavailable until restarted (or indefinitely if the attacker repeats the request).
• A CLI-based pipeline job fails, potentially corrupting or halting downstream processing.
• If Dasel runs as a shared library inside a larger application, the entire application process dies — not just the parsing thread.

No code execution, data exfiltration, or privilege escalation is possible from this vulnerability. The impact is purely availability.

Impact Assessment

CVSS 6.2 (Medium) — CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

• Attack Vector (Local): Exploitation requires the attacker to supply input to the vulnerable process. While often local, this also applies to remote services that accept JSON/XML input — the vector is scored Local because the vulnerable component itself processes data, though the input may arrive remotely.
• Attack Complexity (Low): No special conditions are required. The attacker simply supplies deeply nested input.
• Privileges Required (None): No authentication is needed.
• User Interaction (None): No victim action is required beyond the application processing the input.
• Scope (Unchanged): The impact is confined to the vulnerable component's process.
• Confidentiality (None): No data exposure.
• Integrity (None): No data modification.
• Availability (High): The entire process terminates — a complete loss of availability for that process.

Blast Radius: Any service, pipeline, or application that processes untrusted data through Dasel 3.0.0–3.11.0. Multi-tenant services are at elevated risk because a single attacker can repeatedly crash shared processes. In containerized environments, a crash triggers restart loops that may degrade cluster resources.

Detection Guidance

Sigma Rule

title: Dasel Deeply Nested Input Stack Exhaustion Attempt
id: 8f4a2c1e-9b3d-4e7f-a1c2-6d8e5f0b3a9c
status: experimental
description: Detects process crashes or fatal stack overflow errors in Dasel when parsing deeply nested JSON or XML input (CVE-2026-59168).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-59168
author: valtersit.com
date: 2026/01/01
tags:
  - attack.impact
  - attack.t1499
logsource:
  category: application
  product: dasel
detection:
  selection_fatal:
    message|contains:
      - 'fatal error: stack overflow'
      - 'goroutine stack exceeds'
  selection_process:
    Image|endswith: '/dasel'
  condition: selection_fatal and selection_process
falsepositives:
  - Legitimate deeply nested configuration files (rare)
level: high

YARA Rule

rule CVE_2026_59168_Dasel_Deep_Nesting
{
    meta:
        description = "Detects deeply nested JSON/XML payloads targeting Dasel CVE-2026-59168"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-59168"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $json_open = "{"
        $json_arr  = "["
        $xml_open  = "<"

    condition:
        // Detect payloads with extreme nesting depth indicative of stack exhaustion attempts
        ( #json_open > 500 or #json_arr > 500 ) or
        ( #xml_open > 500 and filesize < 1MB )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-59168 Dasel Deeply Nested JSON Stack Exhaustion Attempt"; flow:established,to_server; http.request_body; content:"{"; depth:1; pcre:"/(\{[^\}]*){500,}/sR"; threshold:type both, track by_src, count 1, seconds 60; classtype:attempted-dos; sid:202659168; rev:1; reference:cve,2026-59168; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

process where process.name == "dasel" and
  message : ("fatal error: stack overflow" or "goroutine stack exceeds" or "runtime: goroutine stack exceeds")

Splunk SPL Query

index=main sourcetype=dasel:logs OR sourcetype=application:stderr
| search "dasel" AND ("fatal error: stack overflow" OR "goroutine stack exceeds" OR "stack overflow")
| stats count min(_time) as first_seen max(_time) as last_seen by host, process
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="dasel,cve-2026-59168,">
  <rule id="100591" level="12">
    <decoded_as>json</decoded_as>
    <field name="message">fatal error: stack overflow</field>
    <description>CVE-2026-59168: Dasel process crashed due to stack overflow from deeply nested input</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
  <rule id="100592" level="10">
    <decoded_as>json</decoded_as>
    <field name="message">goroutine stack exceeds</field>
    <description>CVE-2026-59168: Dasel goroutine stack limit exceeded - possible DoS attempt</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

Note on patch status: The NVD description states the issue is fixed in version 3.11.1. However, no patch evidence was available from tracked sources at the time of this report. The guidance below reflects the vendor-stated fix version and general hardening measures.

1) Immediate Mitigations

• Upgrade to Dasel 3.11.1 or later as stated in the NVD description. This is the definitive remediation.
• If upgrade is not immediately possible, restrict untrusted input: do not pass user-supplied JSON or XML directly to Dasel 3.0.0–3.11.0.
• Implement input size and depth pre-validation at the application boundary before invoking Dasel. Reject payloads exceeding a safe nesting depth (e.g., 100 levels) and a conservative byte size.
• For CLI usage, run Dasel in a sandboxed process with automatic restart and resource limits (e.g., systemd Restart=always, cgroup memory limits, or container restart policies).
• For library usage, isolate Dasel parsing into a separate process or goroutine boundary where a crash does not terminate the parent application.

2) Patch / Upgrade Steps

• Update the Dasel dependency or binary to version 3.11.1.
• For Go library consumers: go get github.com/tomwright/dasel/v3@v3.11.1 (verify module path against vendor documentation) and rebuild.
• For CLI consumers: download the 3.11.1 release binary or update via your package manager.
• Verify the upgrade by parsing a known deeply nested test payload and confirming the process does not crash.

3) Long-Term Hardening

• Adopt strict input validation for all parsing operations: enforce maximum nesting depth, maximum element count, and maximum document size.
• Never parse untrusted structured data in the same process as critical application logic. Use process isolation or worker sandboxes.
• Monitor for fatal error: stack overflow and process restarts in application logs as a signal of exploitation attempts.
• Include Dasel and similar recursive parsers in dependency scanning and SBOM tracking to ensure timely updates.
• Consider replacing unbounded recursive parsers with iterative or depth-limited alternatives in custom code.

References

• NVD — CVE-2026-59168
• CWE-674: Uncontrolled Recursion
• Dasel GitHub Repository
• MITRE ATT&CK T1499: Endpoint Denial of Service
• Go Runtime: Stack Management and fatal error: stack overflow