Dasel, a command‑line tool and library for manipulating structured data, contains an unbounded recursion flaw in its JSON and XML parsing routines in versions 3.0.0 through 3.11.1. The decoder recurses once per nesting level without a depth guard, so a deeply nested attacker‑controlled JSON or XML document can exhaust the Go goroutine stack. When the stack overflows, the Go runtime aborts with an unrecoverable fatal error that terminates the entire dasel process, causing a denial‑of‑service condition for any service or batch job that relies on dasel.

The vulnerability affects the TomWright:dasel product, specifically all releases from 3.0.0 up to and including 3.11.1. Both the command‑line interface and the underlying library functions that accept custom JSON or XML inputs are impacted when the recursive parsing is invoked through parsing.Format(...).NewReader(...).Read(data) or the parse selector function.

The CVSS score of 6.2 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. From the description, the likely attack vector is the delivery of a deeply nested malicious JSON or XML document to dasel via its CLI or library API; no elevated privileges or additional conditions are needed. When triggered, the stack overflow causes the dasel process to terminate, exposing any dependent services to a denial‑of‑service impact.