CVE-2026-33320
MEDIUMDasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service
Title source: cnaExploitation Summary
EIP tracks 5 public exploits for CVE-2026-33320. PoCs published by Omer-Asher, GonSarrabia, rotavori.
AI-analyzed exploit summary This repository provides a backported patch for CVE-2026-33320, a YAML parsing vulnerability in Dasel v3.3.1 that allows denial-of-service via unbounded recursive alias expansion (Billion Laughs attack). The patch introduces an alias expansion budget to mitigate the issue, and includes regression tests.
Description
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. Starting in version 3.0.0 and prior to version 3.3.1, Dasel's YAML reader allows an attacker who can supply YAML for processing to trigger extreme CPU and memory consumption. The issue is in the library's own `UnmarshalYAML` implementation, which manually resolves alias nodes by recursively following `yaml.Node.Alias` pointers without any expansion budget, bypassing go-yaml v4's built-in alias expansion limit. Version 3.3.2 contains a patch for the issue.
Exploits (5)
This repository provides a backported patch for CVE-2026-33320, a YAML parsing vulnerability in Dasel v3.3.1 that allows denial-of-service via unbounded recursive alias expansion (Billion Laughs attack). The patch introduces an alias expansion budget to mitigate the issue, and includes regression tests.
This repository provides a detailed analysis and patch for CVE-2026-33320, a YAML expansion vulnerability in the 'dasel' tool. It includes a patch to mitigate YAML bomb attacks by introducing depth and budget limits for alias expansion.
This repository provides a detailed technical analysis and patch for CVE-2026-33320, a YAML alias expansion vulnerability in dasel. It includes a patch file, notes on the vulnerability, and tests to verify the fix.
This repository provides a detailed technical analysis and hardened container build for dasel v3.3.1, including a build-time patch for CVE-2026-33320 (unbounded YAML alias expansion). It includes a comprehensive breakdown of the vulnerability, patch mechanics, and security hardening measures.
This repository provides a detailed technical analysis and hardened container build for dasel v3.3.1, including a build-time patch for CVE-2026-33320 (unbounded YAML alias expansion). It includes comprehensive documentation, patch details, and security hardening measures.
References (1)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H