Dasel
Monthly
Deeply nested JSON or XML parsed by Dasel 3.0.0 through 3.11.0 exhausts the Go goroutine stack and triggers an unrecoverable fatal error that terminates the entire process, giving attackers a denial-of-service condition against any tool, pipeline, or service that runs dasel on untrusted documents. Exploitation requires the attacker to control the parsed input - via the dasel CLI, the parse selector function, or a program embedding the library through parsing.Format(...).NewReader(...).Read(data) - and the assessed vector is local (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so realistic risk concentrates on wrappers that feed externally sourced data into dasel. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the flaw is strictly availability-only: there is no confidentiality or integrity impact, and the fix in 3.11.1 simply rejects input nested beyond 10,000 levels.
Trailing whitespace at the end of a selector string makes Dasel 3.0.0 through 3.11.1 read past the end of its input and panic with an index-out-of-range error, terminating the process - an availability-only denial of service. The trigger is trivially small (dasel query 'a ', or a selector ending in a tab or newline) and is reachable both from the command line and from the Go library entry points dasel.Query and lexer.NewTokenizer(...).Tokenize(), so any embedding application that forwards caller-influenced selector text into Dasel can be crashed. The assessed impact is local and unauthenticated with high availability impact and no confidentiality or integrity effect (CVSS 6.2), no public exploit code was identified at time of analysis, and version 3.11.2 is the fixed release.
Deeply nested JSON or XML parsed by Dasel 3.0.0 through 3.11.0 exhausts the Go goroutine stack and triggers an unrecoverable fatal error that terminates the entire process, giving attackers a denial-of-service condition against any tool, pipeline, or service that runs dasel on untrusted documents. Exploitation requires the attacker to control the parsed input - via the dasel CLI, the parse selector function, or a program embedding the library through parsing.Format(...).NewReader(...).Read(data) - and the assessed vector is local (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so realistic risk concentrates on wrappers that feed externally sourced data into dasel. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the flaw is strictly availability-only: there is no confidentiality or integrity impact, and the fix in 3.11.1 simply rejects input nested beyond 10,000 levels.
Trailing whitespace at the end of a selector string makes Dasel 3.0.0 through 3.11.1 read past the end of its input and panic with an index-out-of-range error, terminating the process - an availability-only denial of service. The trigger is trivially small (dasel query 'a ', or a selector ending in a tab or newline) and is reachable both from the command line and from the Go library entry points dasel.Query and lexer.NewTokenizer(...).Tokenize(), so any embedding application that forwards caller-influenced selector text into Dasel can be crashed. The assessed impact is local and unauthenticated with high availability impact and no confidentiality or integrity effect (CVSS 6.2), no public exploit code was identified at time of analysis, and version 3.11.2 is the fixed release.