---
title: "CVE-2026-33320\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2026-33320?format=md
keywords: index, follow
---

# CVE-2026-33320

Publication date 24 March 2026

Last updated 1 April 2026

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**6.2 · Medium**

[Score breakdown](https://ubuntu.com/security/CVE-2026-33320?format=md#impact-score)

Toggle side navigation

## Description

Dasel is a command-line tool and library for querying, modifying, and
transforming data structures. Starting in version 3.0.0 and prior to
version 3.3.1, Dasel's YAML reader allows an attacker who can supply YAML
for processing to trigger extreme CPU and memory consumption. The issue is
in the library's own `UnmarshalYAML` implementation, which manually
resolves alias nodes by recursively following `yaml.Node.Alias` pointers
without any expansion budget, bypassing go-yaml v4's built-in alias
expansion limit. Version 3.3.2 contains a patch for the issue.

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| dasel | 26.04 LTS resolute | Needs evaluation |
| 25.10 questing | Ignored end of life, was needs-triage |
| 24.04 LTS noble | Needs evaluation |
| 22.04 LTS jammy | Not in release |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

6.2 · Medium

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Local |
  | Attack complexity | Low |
  | Privileges required | None |
  | User interaction | None |
  | Scope | Unchanged |
  | Confidentiality impact | None |
  | Integrity impact | None |
  | Availability impact | High |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 6.2 · Medium |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33320)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-33320)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2026-33320)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2026-33320)

### Other references

* <https://www.cve.org/CVERecord?id=CVE-2026-33320>
* <https://github.com/TomWright/dasel/security/advisories/GHSA-4fcp-jxh7-23x8>
* <https://github.com/TomWright/dasel/pull/531>