Memory Allocation Vulnerability in CEL Environment by Google
CVE-2026-83530

6.9MEDIUM

Key Information:

Vendor

Google
Status
Cel-go
Vendor
CVE Published:
9 September 2026

What is CVE-2026-83530?

A vulnerability exists in the Common Expression Language (CEL) environment developed by Google, allowing a user to submit expressions that exceed the configured ParserExpressionSizeLimit. Due to improper enforcement of this limit, a dangerous memory allocation occurs based on the input size before validation takes place, potentially leading to resource exhaustion or other security implications. It is crucial for users to monitor and manage input lengths to mitigate the risk associated with this vulnerability.

Affected Version(s)

cel-go 0 < 0.29.0

References

https://github.com/cel-expr/cel-go/pull/1302

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ali Firas (thesmartshadow)
.