Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service
概要
Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. Starting in version 3.0.0 and prior to version 3.3.1, Dasel's YAML reader allows an attacker who can supply YAML for processing to trigger extreme CPU and memory consumption. The issue is in the library's own UnmarshalYAML implementation, which manually resolves alias nodes by recursively following yaml.Node.Alias pointers without any expansion budget, bypassing go-yaml v4's built-in alias expansion limit. Version 3.3.2 contains a patch for the issue.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Ubuntu UBUNTU-CVE-2026-33320 dasel
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov