CVE-2026-59168: falha de média gravidade em TomWright dasel
Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.2epss 0.1%
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/json_reader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard. Deeply nested attacker-controlled JSON or XML supplied through parsing.Format(...).NewReader(...).Read(data), the command-line interface, or the parse selector function can exhaust the Go goroutine stack and raise an unrecoverable fatal error that terminates the entire process. The XML input-size limit does not prevent depth exhaustion, and defer or recover cannot intercept the failure. This issue is fixed in version 3.11.1.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
TomWright · daselCVEs relacionadas — TomWright dasel
No mesmo produto, das mais perigosas para as menos.
CVE-2026-33320MEDIUMDasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of serviceEPSS 0.2%CVE-2026-62866MEDIUMDasel: Selector lexer panics on trailing whitespace in `parseCurRune`EPSS 0.2%CVE-2026-46377MEDIUMDasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted stringEPSS 0.2%CVE-2026-46378MEDIUMDasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literalEPSS 0.2%