CVE-2026-46378: falha de média gravidade em TomWright dasel
Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.2epss 0.2%
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the selector lexer matchRegexPattern closure in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go loops while tokenizing an unterminated regex literal such as r/ because peekRuneEqual returns false after the end of input, allowing attacker-controlled selector strings to consume CPU indefinitely. This issue is fixed in version 3.10.1.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
TomWright · daselCVEs relacionadas — TomWright dasel
No mesmo produto, das mais perigosas para as menos.
CVE-2026-33320MEDIUMDasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of serviceEPSS 0.2%CVE-2026-62866MEDIUMDasel: Selector lexer panics on trailing whitespace in `parseCurRune`EPSS 0.2%CVE-2026-46377MEDIUMDasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted stringEPSS 0.2%CVE-2026-59168MEDIUMDasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoSEPSS 0.1%