Approved changes feed: RSS · Atom
cpe:2.3:a:tomwright:dasel:*:*:*:*:*:go:*:*part: a version: * update: *
| Vendor | Tomwright (37bf8006-6b88-50ce-ab19-801aa9fb805a) |
|---|---|
| Product | Dasel (1ccf73b5-aa7c-51b2-9260-5e67b5b4ac51) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | go |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/tomwright/dasel |
purl2cpe | 2026-06-01 10:12:00.097060 |
pkg:golang/github.com/tomwright/dasel |
purl2cpe | 2026-06-01 10:12:00.097062 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-33320 |
vulnerable | 2026-06-08 07:59:09.676989 |
Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service
MEDIUM (6.2)
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. Starting in version 3.0.0 and prior to version 3.3.1, Dasel's YAML reader allows an attacker who can supply YAML for processing to trigger extreme CPU and memory consumption. The issue is in the library's own `UnmarshalYAML` implementation, which manually resolves alias nodes by recursively following `yaml.Node.Alias` pointers without any expansion budget, bypassing go-yaml v4's built-in alias expansion limit. Version 3.3.2 contains a patch for the issue.
Published: 2026-03-24T00:06:22.351Z
Updated: 2026-03-26T12:24:32.421Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.