A vulnerability in the dasel data processing library allows for denial of service attacks by exhausting the Go goroutine stack through uncontrolled recursion.

The software fails to implement depth guards during the parsing of JSON and XML structures, leading to uncontrolled recursion. An unauthenticated attacker can trigger this flaw by providing a maliciously crafted, deeply nested input file to the command line interface or library functions.

Successful exploitation of this vulnerability results in an unrecoverable fatal error that terminates the dasel process. Given the CVSS score of 6.2, the primary impact is a Denial of Service (DoS) condition. This may disrupt automated data transformation pipelines or administrative workflows that rely on dasel for processing sensitive or operational data, potentially leading to significant downtime in affected systems.

Immediate Action: Update the dasel library to version 3.11.1 or later to implement the necessary recursion depth guards.

Proactive Monitoring: Review application logs for unexpected process crashes or fatal errors occurring during the ingestion of JSON or XML data inputs.

Compensating Controls: Implement strict input validation or size and depth limitations at the application layer before passing data to the dasel parser to prevent the processing of excessively nested structures.

Public Exploit Available: No

While the CVSS score of 6.2 categorizes this as a medium severity issue, the impact on availability makes it a priority for environments that process untrusted or user-supplied data. Organizations should prioritize patching to version 3.11.1 to eliminate the recursion risk and ensure stability in their data processing pipelines.