CVE-2026-83530: Uncontrolled Memory Allocation in cel-go
Published Sep 9, 2026
·Updated
A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.
Affected Software
1 affected component
cel-go
Event History
Sep 9, 2026
CVE Published
via MITRE·02:56 PM
Data Sourced
via MITRE·02:56 PM
DescriptionWeakness
Frequently Asked Questions
1
Who is exposed to this issue?
Deployments are exposed when users can supply CEL expressions to a CEL environment. An expression longer than the configured ParserExpressionSizeLimit() can cause an allocation proportional to the input size before the limit is enforced.
2
Does ParserExpressionSizeLimit() prevent the allocation from occurring?
No. The allocation occurs before ParserExpressionSizeLimit() is checked and enforced, so the configured limit does not prevent memory use proportional to an oversized input.