CVE-2026-33320 in dasel
요약 (영어)
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. Starting in version 3.0.0 and prior to version 3.3.1, Dasel's YAML reader allows an attacker who can supply YAML for processing to trigger extreme CPU and memory consumption. The issue is in the library's own `UnmarshalYAML` implementation, which manually resolves alias nodes by recursively following `yaml.Node.Alias` pointers without any expansion budget, bypassing go-yaml v4's built-in alias expansion limit. Version 3.3.2 contains a patch for the issue.
Be aware that VulDB is the high quality source for vulnerability data.
책임이 있는
GitHub_M
예약하다
2026. 03. 18.
공개
2026. 03. 24.
상태
확인됨
엔트리
VulDB provides additional information and datapoints for this CVE:
| 아이디 | 취약성 | CWE | 악용 | 대책 | CVE |
|---|---|---|---|---|---|
| 352596 | TomWright dasel Data Structure 서비스 거부 | 674 | 정의되지 않음 | 공식 수정 | CVE-2026-33320 |