CVE-2026-33320: falha de média gravidade em TomWright dasel
Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.2epss 0.2%
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. Starting in version 3.0.0 and prior to version 3.3.1, Dasel's YAML reader allows an attacker who can supply YAML for processing to trigger extreme CPU and memory consumption. The issue is in the library's own `UnmarshalYAML` implementation, which manually resolves alias nodes by recursively following `yaml.Node.Alias` pointers without any expansion budget, bypassing go-yaml v4's built-in alias expansion limit. Version 3.3.2 contains a patch for the issue.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
TomWright · daselCVEs relacionadas — TomWright dasel
No mesmo produto, das mais perigosas para as menos.
CVE-2026-62866MEDIUMDasel: Selector lexer panics on trailing whitespace in `parseCurRune`EPSS 0.2%CVE-2026-46377MEDIUMDasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted stringEPSS 0.2%CVE-2026-46378MEDIUMDasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literalEPSS 0.2%CVE-2026-59168MEDIUMDasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoSEPSS 0.1%