CVE-2026-33320: 
NixOS vulnerability analysis and mitigation

CVE-2026-33320 is an unbounded YAML alias expansion vulnerability in Dasel, a command-line tool and Go library for querying and transforming data structures. Affecting versions 3.0.0 through 3.3.1, the flaw allows an attacker who can supply YAML input to trigger extreme CPU and memory consumption, resulting in a denial-of-service condition. It was published on March 24, 2026, with the patch released in version 3.3.2. The vulnerability carries a CVSS v3.1 base score of 6.2 (Medium) (GitHub Advisory).

The root cause is classified as CWE-674 (Uncontrolled Recursion). Dasel's custom UnmarshalYAML(*yaml.Node) implementation in parsing/yaml/yaml_reader.go manually resolves YAML alias nodes by recursively following yaml.Node.Alias pointers without any expansion budget or counter. This bypasses go-yaml v4's built-in alias expansion limit, which only applies to the standard Unmarshal path — not to custom UnmarshalYAML hooks that receive a raw *yaml.Node tree. When an AliasNode is encountered, the handler at lines 119–126 calls newVal.UnmarshalYAML(value.Alias) recursively without tracking expansion count. A 9-level alias bomb (each level referencing the previous 9 times) produces hundreds of millions of recursive expansions from a 342-byte input, causing 100% CPU utilization and unbounded memory growth until the process is externally terminated (GitHub Advisory).

Successful exploitation causes the affected process to consume 100% CPU and exhibit continuously growing memory usage until it is externally killed, effectively rendering the application unavailable. Both CLI usage (reading YAML from stdin or files) and library usage (any application embedding Dasel's YAML reader to parse untrusted YAML) are affected, including the parse("yaml", ...) selector function. There is no confidentiality or integrity impact; the sole consequence is a high-severity availability loss (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of a complete, standalone Go program that demonstrates the denial-of-service by feeding a crafted 342-byte YAML alias bomb to Dasel's reader. The PoC was confirmed on Dasel v3.3.1 and the default branch at the time of disclosure, with the process failing to complete within 5 seconds and exhibiting unbounded resource growth. No in-the-wild exploitation has been reported. The EPSS score is approximately 0.013% (0.000130), indicating low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Identify target: Locate an application or service that uses Dasel v3.0.0–3.3.1 to process YAML input supplied by users, such as a CLI tool accepting YAML from stdin or a web service that passes user-provided YAML to Dasel's reader.
2. Craft alias bomb payload: Construct a YAML document using nested alias references. A 342-byte, 9-level alias bomb is sufficient:

a: &a ["lol","lol","lol","lol","lol","lol","lol","lol","lol"]
b: &b [*a,*a,*a,*a,*a,*a,*a,*a,*a]
c: &c [*b,*b,*b,*b,*b,*b,*b,*b,*b]
d: &d [*c,*c,*c,*c,*c,*c,*c,*c,*c]
e: &e [*d,*d,*d,*d,*d,*d,*d,*d,*d]
f: &f [*e,*e,*e,*e,*e,*e,*e,*e,*e]
g: &g [*f,*f,*f,*f,*f,*f,*f,*f,*f]
h: &h [*g,*g,*g,*g,*g,*g,*g,*g,*g]
i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h]

3. Submit payload: Provide the crafted YAML to the vulnerable Dasel reader, e.g., via stdin (echo '<payload>' | dasel -f yaml), a file argument, or an API endpoint that passes the content to parsing.Format("yaml").NewReader().
4. Trigger DoS: Dasel's UnmarshalYAML recursively expands alias nodes without a budget, causing hundreds of millions of recursive calls. The process consumes 100% CPU and grows memory unboundedly, becoming unresponsive and causing denial of service (GitHub Advisory).

• Process Behavior: The Dasel process (or any Go application embedding Dasel's YAML reader) pegged at 100% CPU utilization for an extended period without completing; continuously growing memory (RSS) with no upper bound.
• Logs: Application logs showing a YAML parsing operation that never returns or times out; absence of a completion log entry after a YAML read operation begins.
• Network/Input: Receipt of unusually small YAML payloads (e.g., ~342 bytes) containing deeply nested anchor/alias structures (&a, *a, etc.) submitted to YAML-processing endpoints or stdin.
• System: OOM-killer events (oom_kill_process) in kernel logs targeting the Dasel process; system-level alerts for runaway CPU or memory consumption by a Go process (GitHub Advisory).

The primary remediation is to upgrade Dasel to version 3.3.2 or later, which contains a patch for this issue. For applications that cannot immediately upgrade, restrict the ability to supply untrusted YAML input to Dasel (e.g., validate or sanitize input before passing it to the library). As an additional mitigation, apply OS-level resource limits (CPU time limits via ulimit or cgroups, and memory caps) on processes running Dasel to bound the impact of a potential denial-of-service attack. Detection via Nessus (plugin 304088) and Qualys (plugin 761875) is available (GitHub Advisory).

The vulnerability was reported by researcher kq5y and published by TomWright (the library maintainer) as a GitHub Security Advisory on March 18, 2026. The advisory was picked up by GitLab's advisory database, openSUSE security announcements, and Linux security news aggregators shortly after disclosure. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database propagation.