CVE-2026-33320CWE-674

Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service

Medium · published March 24, 2026

CVSS v3.1
6.2
EPSS
0%
Percentile
6.9
In the wild
Unconfirmed
What it is

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. Starting in version 3.0.0 and prior to version 3.3.1, Dasel's YAML reader allows an attacker who can supply YAML for processing to trigger extreme CPU and memory consumption. The issue is in the library's own `UnmarshalYAML` implementation, which manually resolves alias nodes by recursively following `yaml.Node.Alias` pointers without any expansion budget, bypassing go-yaml v4's built-in alias expansion limit. Version 3.3.2 contains a patch for the issue.

The record
Technical detail
CVSS v3.1
6.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00177 · 6.9th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-03-24T00:06Z
EPSS history
Timeline
  • 24 MAR 00:06Z
    Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service
    cvelistv5