Vulnerability · Published Mar 24, 2026 · Assigned by GitHub_M
CVE-2026-33320Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service
Medium 6.2
In plain English
A medium-severity security flaw in dasel from TomWright. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. Starting in version 3.0.0 and prior to version 3.3.1, Dasel's YAML reader allows an attacker who can supply YAML for processing to trigger extreme CPU and memory consumption. The issue is in the library's own `UnmarshalYAML` implementation, which manually resolves alias nodes by recursively following `yaml.Node.Alias` pointers without any expansion budget, bypassing go-yaml v4's built-in alias expansion limit. Version 3.3.2 contains a patch for the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/tomwright/dasel | no fix listed | GO-2026-4768 |
| Go | github.com/tomwright/dasel/v2 | no fix listed | GO-2026-4768 |
| Go | github.com/tomwright/dasel/v3 | 3.3.2 | GHSA-4fcp-jxh7-23x8 |
| Go | github.com/tomwright/dasel/v3 | 3.3.2 | GO-2026-4768 |
| Ubuntu:25.10 | dasel | no fix listed | UBUNTU-CVE-2026-33320 |
| Ubuntu:26.04:LTS | dasel | no fix listed | UBUNTU-CVE-2026-33320 |
| Ubuntu:26.10 | dasel | no fix listed | UBUNTU-CVE-2026-33320 |
Affected products (as reported)
Weakness: CWE-674 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/TomWright/dasel/security/advisories/GHSA-4fcp-jxh7-23x8 x_refsource_CONFIRM