CVE-2026-33320: Tomwright Dasel DOS Vulnerability

CVE-2026-33320 Overview

CVE-2026-33320 is a resource exhaustion vulnerability affecting Dasel, a popular command-line tool and library for querying, modifying, and transforming data structures. The vulnerability exists in Dasel's YAML reader implementation, which allows an attacker who can supply YAML content for processing to trigger extreme CPU and memory consumption. This denial-of-service condition occurs because the library's custom UnmarshalYAML implementation manually resolves alias nodes by recursively following yaml.Node.Alias pointers without any expansion budget, effectively bypassing go-yaml v4's built-in alias expansion limit.

Critical Impact

Attackers can craft malicious YAML documents with recursive alias structures that cause unbounded resource consumption, leading to denial of service on systems processing untrusted YAML input through Dasel.

Affected Products

• Tomwright Dasel versions 3.0.0 through 3.3.1
• Dasel Go library (cpe:2.3:a:tomwright:dasel::::::go::*)
• Applications and pipelines that process untrusted YAML input using affected Dasel versions

Discovery Timeline

• 2026-03-24 - CVE CVE-2026-33320 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-33320

Vulnerability Analysis

This vulnerability is classified under CWE-674 (Uncontrolled Recursion), which occurs when a product does not properly control the amount of recursion that takes place, consuming excessive resources. The issue specifically affects the YAML parsing functionality introduced in Dasel version 3.0.0.

The vulnerability stems from Dasel's custom implementation of the UnmarshalYAML interface. When processing YAML documents containing alias nodes (denoted by the * anchor reference syntax in YAML), the library recursively follows yaml.Node.Alias pointers to resolve the referenced content. However, this implementation lacks any limit on the number of alias expansions that can occur, creating a potential for exponential resource consumption.

Go-yaml v4 includes built-in protections against alias expansion attacks, but Dasel's custom unmarshaling logic bypasses these safeguards entirely. An attacker can exploit this by crafting a YAML document with deeply nested or self-referencing alias structures that cause the parser to consume excessive CPU cycles and memory during the resolution process.

Root Cause

The root cause is the absence of an expansion budget or recursion limit in Dasel's UnmarshalYAML implementation. When the library encounters a YAML alias node, it follows the yaml.Node.Alias pointer to retrieve the referenced node's value. Without tracking the depth or count of alias expansions, maliciously crafted YAML documents can trigger unbounded recursive processing.

The go-yaml v4 library implements an alias expansion limit specifically to prevent this class of attack, but by implementing custom alias resolution logic, Dasel inadvertently circumvents this protection mechanism.

Attack Vector

The attack requires local access, meaning an attacker must be able to supply YAML content that will be processed by Dasel. This could occur in scenarios such as:

• Processing user-uploaded configuration files
• Parsing YAML data from untrusted sources in CI/CD pipelines
• Command-line usage where input files come from external sources
• Applications using the Dasel library to process YAML from network endpoints

An attacker can craft a YAML document containing alias constructs that exploit the lack of expansion limits. When processed by vulnerable Dasel versions, the recursive alias resolution consumes memory and CPU resources until the system becomes unresponsive or the process is terminated.

The vulnerability mechanism involves creating YAML documents with alias structures that reference other aliases in a pattern that causes exponential expansion. Technical details are available in the GitHub Security Advisory.

Detection Methods for CVE-2026-33320

Indicators of Compromise

• Abnormally high CPU utilization in processes running Dasel or applications using the Dasel library
• Memory consumption spikes correlated with YAML file processing operations
• Process hangs or system unresponsiveness during YAML parsing activities
• Presence of unusually large or complex YAML files with extensive alias definitions in processing queues

Detection Strategies

• Monitor resource consumption patterns for applications using Dasel for YAML processing
• Implement alerting on processes that exceed expected CPU or memory thresholds during file operations
• Audit dependencies to identify applications using vulnerable Dasel versions (3.0.0 through 3.3.1)
• Review input validation practices for systems accepting YAML content from external sources

Monitoring Recommendations

• Configure process-level resource monitoring for services that handle YAML parsing
• Set up alerts for runaway processes consuming excessive CPU or memory
• Implement timeout mechanisms for YAML processing operations as a defense-in-depth measure
• Log and monitor the size and complexity of YAML documents being processed

How to Mitigate CVE-2026-33320

Immediate Actions Required

• Upgrade Dasel to version 3.3.2 or later, which contains the security patch
• Audit applications and build pipelines to identify all instances of Dasel usage
• Implement input validation to reject or limit the complexity of YAML documents from untrusted sources
• Consider implementing resource limits (cgroups, ulimits) for processes handling untrusted YAML input

Patch Information

The vulnerability has been addressed in Dasel version 3.3.2. The fix implements an expansion budget that limits the number of alias resolutions during YAML parsing, preventing the unbounded recursion that enables this denial-of-service attack. Organizations should update to the patched version as soon as possible.

For detailed patch information and security guidance, refer to the GitHub Security Advisory GHSA-4fcp-jxh7-23x8.

Workarounds

• Avoid processing YAML content from untrusted or unverified sources until the patch can be applied
• Implement process-level resource limits to contain the impact of potential exploitation attempts
• Use containerization with strict resource constraints when running Dasel operations on external data
• Consider pre-validating YAML input using alternative parsers with built-in alias limits before passing to Dasel

# Update Dasel to the patched version
go get github.com/TomWright/dasel@v3.3.2

# Or using go mod
go mod edit -require github.com/TomWright/dasel@v3.3.2
go mod tidy