Skip to content
OpenAdvisories
Medium · 6.2 CVE-2026-46378 EUVD-2026-44994GHSA-m6xr-fvfg-5g64GO-2026-5493

Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal

Published Jul 16, 2026 · Updated Jul 17, 2026 · Assigned by GitHub_M

Description

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the selector lexer matchRegexPattern closure in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go loops while tokenizing an unterminated regex literal such as r/ because peekRuneEqual returns false after the end of input, allowing attacker-controlled selector strings to consume CPU indefinitely. This issue is fixed in version 3.10.1.

Affected products

VendorProductAffectedFixed
TomWright dasel >= 3.0.0, < 3.10.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 dasel 3.11.0-1 —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 dasel No fix yet —
Ubuntu 26.04 LTS dasel No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS dasel No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling vale 3.14.2-r1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/tomwright/dasel all versions — GO-2026-5493
Go github.com/tomwright/dasel/v2 all versions — GO-2026-5493
Go github.com/tomwright/dasel/v3 >= 3.0.0, < 3.10.1 3.10.1 GHSA-m6xr-fvfg-5g64

Advisories 1

References