CVE-2026-59168: Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS

dasel’s JSON and XML readers parse nested structures with unbounded recursion, one native stack frame per nesting level, with no depth guard. A small (sub-10 MB), deeply nested document drives the Go runtime past its goroutine stack limit and triggers a fatal error: stack overflow. This is unrecoverable: it is a runtime fatal error, not a panic, so a consumer’s defer/recover cannot intercept it, the entire process dies.

Both readers are affected; neither has a depth limit, and the JSON reader additionally has no input-size cap (the XML reader caps size at 10 MB but not depth).