30 matches found
CVE-2026-72923
Microsoft.OpenApi.YamlReader (versions 2.0.0-preview.11 through 2.12.0 and 3.0.0 through 3.10.0) and Microsoft.OpenApi.Readers (prior to 1.6.30) are vulnerable to a denial of service via YAML alias expansion. The root cause lies in how SharpYaml represents aliases as shared nodes in a directed ac...
CVE-2026-72923 Microsoft.OpenApi.YamlReader/Readers vulnerable to denial of service via YAML alias expansion
In Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 until 2.12.0 and from 3.0.0 until 3.10.0, and in Microsoft.OpenApi.Readers prior to 1.6.30, a small YAML OpenAPI document containing nested anchors and aliases can cause uncontrolled resource consumption when parsed through the public YAML...
CVE-2026-72923 Microsoft.OpenApi.YamlReader/Readers vulnerable to denial of service via YAML alias expansion
In Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 until 2.12.0 and from 3.0.0 until 3.10.0, and in Microsoft.OpenApi.Readers prior to 1.6.30, a small YAML OpenAPI document containing nested anchors and aliases can cause uncontrolled resource consumption when parsed through the public YAML...
dasel-hardened-container
dasel v3.3.1 加固容器 这是一个针对 dasel v3.3.1 的 melange 包和 apko 容器镜像，包含针对 CVE-2026-33320（无限制的 YAML 别名扩展）的构建时补丁。该镜像完全由本地生成的 APK 构建——不使用任何预构建的上游镜像。 前提条件 工具| 已测试版本| 用途 ---|---|--- Docker| 29.3.1| 容器运行时，通过 compose.yaml 运行 melange/apko melange| 0.50.5 Docker image...
Minimus-Junior-Backend-Exercise
Junior Backend 练习 — dasel v3.3.1 使用 Melange 打包 dasel v3.3.1，用 apko 构建容器镜像，并修复 CVE-2026-33320。 前置条件： Docker。所有构建步骤在容器内运行 — 无需本地安装 melange/apko。所有命令在 linux/amd64（或支持 linux/amd64 模拟的 Docker Desktop）上从仓库根目录执行。 构建与测试 第 0 步 — 生成签名密钥（一次性） root@kitploit: docker run --rm -v "/$PWD":/work...
CVE-2026-45304
CVE-2026-45304 affects Symfony’s YAML Parser (Symfony\Component\Yaml\Parser). Before versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the parser resolved YAML collection aliases recursively, enabling a small untrusted YAML input to expand into a multi-gigabyte structure and exhaust memory. Impact is ...
Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
Description Symfony\Component\Yaml\Parser resolves YAML aliases anchor during parsing. Aliases that reference collections arrays, stdClass, TaggedValue-wrapped collections can themselves point to other collections containing aliases, creating exponential expansion at resolution time. A small inpu...
CVE-2026-33320
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. Starting in version 3.0.0 and prior to version 3.3.1, Dasel's YAML reader allows an attacker who can supply YAML for processing to trigger extreme CPU and memory consumption. The issue is in the...
CVE-2026-33320 Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. Starting in version 3.0.0 and prior to version 3.3.1, Dasel's YAML reader allows an attacker who can supply YAML for processing to trigger extreme CPU and memory consumption. The issue is in the...
CVE-2026-33320 Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service
Dasel is a command-line tool and library for querying, modifying, and transforming data structures. Starting in version 3.0.0 and prior to version 3.3.1, Dasel's YAML reader allows an attacker who can supply YAML for processing to trigger extreme CPU and memory consumption. The issue is in the...
GO-2026-4768 Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service in github.com/tomwright/dasel
Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service in github.com/tomwright/dasel...
GHSA-4FCP-JXH7-23X8 Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service
Summary dasel's YAML reader allows an attacker who can supply YAML for processing to trigger extreme CPU and memory consumption. The issue is in the library's own UnmarshalYAML implementation, which manually resolves alias nodes by recursively following yaml.Node.Alias pointers without any...
Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service
Summary dasel's YAML reader allows an attacker who can supply YAML for processing to trigger extreme CPU and memory consumption. The issue is in the library's own UnmarshalYAML implementation, which manually resolves alias nodes by recursively following yaml.Node.Alias pointers without any...
PT-2026-26480
Name of the Vulnerable Software and Affected Versions Dasel versions 3.0.0 through 3.3.1 Description Dasel’s YAML reader is susceptible to excessive CPU and memory consumption when processing YAML data supplied by an attacker. This occurs because the library’s UnmarshalYAML implementation...
CVE-2026-27807
MarkUs (web app for assignment submission/grading) is affected by CVE-2026-27807 due to YAML files parsed with aliases enabled, enabling a billion‑laughs style DoS. The issue affects configurations uploaded prior to v2.9.4, where YAML parsing could be abused to exhaust resources. The CVSS vector ...
EUVD-2003-1352
Malware in sbrugna...
PT-2023-30338 · Remarshal · Remarshal
Name of the Vulnerable Software and Affected Versions: Remarshal versions prior to 0.17.1 Description: The issue allows for the expansion of YAML alias nodes unlimitedly, making Remarshal susceptible to a Billion Laughs Attack. This can lead to a denial-of-service DoS condition when processing...
SUSE CVE-2007-2683
Buffer overflow in Mutt 1.4.2 might allow local users to execute arbitrary code via "&" characters in the GECOS field, which triggers the overflow during alias expansion...
