EUVD-2026-84017Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Local CLI/library processing of attacker-supplied input (AV:L), no auth or interaction needed to trigger the crash (PR:N/UI:N), impact limited to process termination (A:H only).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/json_reader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard. Deeply nested attacker-controlled JSON or XML supplied through parsing.Format(...).NewReader(...).Read(data), the command-line interface, or the parse selector function can exhaust the Go goroutine stack and raise an unrecoverable fatal error that terminates the entire process. The XML input-size limit does not prevent depth exhaustion, and defer or recover cannot intercept the failure. This issue is fixed in version 3.11.1.
AnalysisAI
Deeply nested JSON or XML parsed by Dasel 3.0.0 through 3.11.0 exhausts the Go goroutine stack and triggers an unrecoverable fatal error that terminates the entire process, giving attackers a denial-of-service condition against any tool, pipeline, or service that runs dasel on untrusted documents. Exploitation requires the attacker to control the parsed input - via the dasel CLI, the parse selector function, or a program embedding the library through parsing.Format(...).NewReader(...).Read(data) - and the assessed vector is local (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so realistic risk concentrates on wrappers that feed externally sourced data into dasel. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the ability to supply attacker-controlled input that dasel parses as JSON or XML - through the dasel CLI, the parse selector function, or any program embedding dasel via parsing.Format(...).NewReader(...).Read(data). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but self-limiting denial-of-service issue (CWE-674 uncontrolled recursion), not a code-execution or data-exposure flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Dasel 3.11.1, which is the vendor-released fix: it enforces a 10,000-level nesting depth limit in both the JSON reader (decodeValue/decodeObject/decodeArray) and the XML reader (parseElement) and returns ErrJSONMaxDepthExceeded or ErrXMLMaxDepthExceeded instead of crashing - see the release at https://github.com/TomWright/dasel/releases/tag/v3.11.1, the advisory GHSA-cqxr-jxr2-85pq, and commit 4c91d0d02dc59ce8404709b1bfed7a6fabe62f68. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
Unauthenticated path traversal in Uber Kraken through 0.1.29 allows remote attackers to read files outside the configure
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
Path traversal in the uniget CLI (Go module gitlab.com/uniget-org/cli) before version 0.27.6 lets a local user read and
The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allow
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
Concurrent SAML or OpenID Connect login attempts against SUSE NeuVector can cause one user to be issued another user's f
Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. Rated high severity (CVS
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today