dasel-hardened-container

dasel v3.3.1 강화 컨테이너 이것은 CVE-2026-33320 무제한 YAML 별칭 확장에 대한 빌드 시 패치가 적용된 dasel v3.3.1용 melange 패키지 및 apko 컨테이너 이미지입니다. 이미지는 로컬에서 생성된 APK로 완전히 빌드되며, 사전 빌드된 업스트림 이미지를 사용하지 않습니다. 전제 조건 도구| 테스트된 버전| 목적 ---|---|--- Docker| 29.3.1| 컨테이너 런타임, compose.yaml을 통해 melange/apko 실행 melange| 0.50.5 Docker 이미지...

Minimus-Junior-Backend-Exercise

주니어 백엔드 실습 — dasel v3.3.1 Melange로 dasel v3.3.1 패키지를 만들고, apko로 컨테이너 이미지를 빌드하며, CVE-2026-33320을 수정합니다. 사전 요구 사항: Docker. 모든 빌드 단계는 컨테이너 안에서 실행됩니다 — 로컬 melange/apko 설치가 필요 없습니다. 모든 명령은 linux/amd64또는 linux/amd64 에뮬레이션을 지원하는 Docker Desktop에서 저장소 루트로부터 실행하세요. 빌드 및 테스트 0단계 — 서명 키 생성1회 docker run --rm ...

CVE-2026-72923 Microsoft.OpenApi.YamlReader/Readers vulnerable to denial of service via YAML alias expansion

In Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 until 2.12.0 and from 3.0.0 until 3.10.0, and in Microsoft.OpenApi.Readers prior to 1.6.30, a small YAML OpenAPI document containing nested anchors and aliases can cause uncontrolled resource consumption when parsed through the public YAML...

CVE-2026-72923

Microsoft.OpenApi.YamlReader (versions 2.0.0-preview.11 through 2.12.0 and 3.0.0 through 3.10.0) and Microsoft.OpenApi.Readers (prior to 1.6.30) are vulnerable to a denial of service via YAML alias expansion. The root cause lies in how SharpYaml represents aliases as shared nodes in a directed ac...

CVE-2026-72923 Microsoft.OpenApi.YamlReader/Readers vulnerable to denial of service via YAML alias expansion

In Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 until 2.12.0 and from 3.0.0 until 3.10.0, and in Microsoft.OpenApi.Readers prior to 1.6.30, a small YAML OpenAPI document containing nested anchors and aliases can cause uncontrolled resource consumption when parsed through the public YAML...

CVE-2026-72923 Microsoft.OpenApi.YamlReader/Readers vulnerable to denial of service via YAML alias expansion

In Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 until 2.12.0 and from 3.0.0 until 3.10.0, and in Microsoft.OpenApi.Readers prior to 1.6.30, a small YAML OpenAPI document containing nested anchors and aliases can cause uncontrolled resource consumption when parsed through the public YAML...

CVE-2026-58486

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, HedgeDoc was vulnerable to a YAML alias bomb due to unsafe processing of the note frontmatter. HedgeDoc parsed frontmatter with js-yaml.load js-yaml v3 via @hedgedoc/meta-marked, which...

EUVD-2026-43572

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, HedgeDoc was vulnerable to a YAML alias bomb due to unsafe processing of the note frontmatter. HedgeDoc parsed frontmatter with js-yaml.load js-yaml v3 via @hedgedoc/meta-marked, which...

CVE-2026-58486 HedgeDoc: Denial-of-service via YAML alias expansion in note frontmatter

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, HedgeDoc was vulnerable to a YAML alias bomb due to unsafe processing of the note frontmatter. HedgeDoc parsed frontmatter with js-yaml.load js-yaml v3 via @hedgedoc/meta-marked, which...

CVE-2026-58486 HedgeDoc: Denial-of-service via YAML alias expansion in note frontmatter

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, HedgeDoc was vulnerable to a YAML alias bomb due to unsafe processing of the note frontmatter. HedgeDoc parsed frontmatter with js-yaml.load js-yaml v3 via @hedgedoc/meta-marked, which...

CVE-2026-58486: Uncontrolled Resource Consumption

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, HedgeDoc was vulnerable to a YAML alias bomb due to unsafe processing of the note frontmatter. HedgeDoc parsed frontmatter with js-yaml.load js-yaml v3 via @hedgedoc/meta-marked, which...

CVE-2026-33320 Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. Starting in version 3.0.0 and prior to version 3.3.1, Dasel's YAML reader allows an attacker who can supply YAML for processing to trigger extreme CPU and memory consumption. The issue is in the...

CVE-2026-33320 Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. Starting in version 3.0.0 and prior to version 3.3.1, Dasel's YAML reader allows an attacker who can supply YAML for processing to trigger extreme CPU and memory consumption. The issue is in the...

GO-2026-4768 Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service in github.com/tomwright/dasel

Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service in github.com/tomwright/dasel...

CVE-2026-27807 MarkUs: YAML alias (‘billion laughs’) DoS in config upload

MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs allows course instructors to upload YAML files to create/update various entities e.g., assignment settings. These YAML files are parsed with aliases enabled. This issue has been patch...

EUVD-2023-0225

Malicious code in bioql PyPI...

CVE-2023-47163

Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack. Processing untrusted YAML files may cause a denial-of-service DoS condition...

CVE-2024-35221 Denial of service when publishing a package on rubygems.org

Rubygems.org is the Ruby community's gem hosting service. A Gem publisher can cause a Remote DoS when publishing a Gem. This is due to how Ruby reads the Manifest of Gem files when using Gem::Specification.fromyaml. fromyaml makes use of SafeYAML.load which allows YAML aliases inside the YAML-bas...

PYSEC-2023-236

Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack. Processing untrusted YAML files may cause a denial-of-service DoS condition...

CVE-2023-47163

Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack. Processing untrusted YAML files may cause a denial-of-service DoS condition...