PT-2026-26480 · Go-Yaml+1 · Go-Yaml+1
Kq5Y
·
Published
2026-03-19
·
Updated
2026-03-27
·
CVE-2026-33320
CVSS v3.1
6.2
Medium
| Vector | AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Dasel versions 3.0.0 through 3.3.1
Description
Dasel’s YAML reader is susceptible to excessive CPU and memory consumption when processing YAML data supplied by an attacker. This occurs because the library’s
UnmarshalYAML implementation recursively resolves YAML alias nodes without any expansion limit, bypassing the built-in alias expansion limit present in go-yaml v4. A relatively small 342-byte payload can trigger this issue, leading to denial of service. The issue resides in the UnmarshalYAML function, which handles alias nodes by recursively following yaml.Node.Alias pointers without a defined expansion budget. This allows an attacker to create a YAML document with deeply nested aliases, causing unbounded resource growth during parsing. The root cause is that Dasel receives a compact Node tree and then re-expands aliases without a limit, unlike go-yaml v4’s Unmarshal function which tracks alias expansion count.Recommendations
Versions prior to 3.3.2 are affected.
Update to version 3.3.2 or later to resolve the issue.
Exploit
Fix
Uncontrolled Recursion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Dasel
Go-Yaml