What’s Vulnerable › Vulnerabilities
CVE-2026-33320: Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service
- Severity: medium (CVSS 6.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-03-24 · updated 2026-06-17
- Weakness: CWE-674
Description
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. Starting in version 3.0.0 and prior to version 3.3.1, Dasel's YAML reader allows an attacker who can supply YAML for processing to trigger extreme CPU and memory consumption. The issue is in the library's own `UnmarshalYAML` implementation, which manually resolves alias nodes by recursively following `yaml.Node.Alias` pointers without any expansion budget, bypassing go-yaml v4's built-in alias expansion limit. Version 3.3.2 contains a patch for the issue.
Affected products
- TomWright dasel: from 3.0.0 before 3.3.2 — fixed in 3.3.2
How to fix
Upgrade to a fixed version: TomWright dasel 3.3.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-33320 or the next vulnerability affects your stack