Dasel's YAML reader can fully expand aliases without any limit, causing extreme CPU and memory usage when parsing malicious YAML. This leads to a denial‑of‑service condition for the process handling the input. The flaw is a classic uncontrolled recursion weakness (CWE‑674). The impact is that an attacker who can supply YAML data to dasel—whether by feeding a file to the command‑line tool or by invoking the library in an application—can exhaust host resources and make the process unresponsive.

TomWright's dasel, versions 3.0.0 through 3.3.1, is affected. Version 3.3.2 fixes the issue.

The CVSS score of 6.2 indicates moderate severity. The EPSS score of less than 1% signals a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA's KEV catalog. Attackers would need to supply crafted YAML to dasel; the vulnerability is local unless an application incorporating dasel processes untrusted data from a remote source. No public exploit is documented. Patch or mitigate the unbounded expansion to eliminate the risk.