Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-83530: cel-go can exhaust memory with long expressions

CVE-2026-83530 · published 1 month ago

Summary

The cel-go library, used in several Go packages, may allocate a large amount of memory if it receives an expression that is longer than the configured limit. This can slow down or crash the application before the limit is enforced. Update to the latest version of the library or configure a stricter size limit to prevent the issue.

What to do

Update debian golang-cel-cel-go to version 0.32.0+ds-1.
Update google cel-go to version 0.29.0 or later.
Update google common_expression_language to version 0.29.0 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	google	cel-go	< 0.29.0
Debian:14	debian	golang-cel-cel-go	< 0.32.0+ds-1 Fix: upgrade to 0.32.0+ds-1
Debian:13	debian	golang-github-google-cel-go	All versions
Ubuntu:24.04:LTS	canonical	golang-github-google-cel-go	All versions
–	google	common_expression_language	< 0.29.0 `cpe:2.3:a:google:common_expression_language::::::go::*`

Original advisory text

Uncontrolled Memory Allocation in cel-go

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.

References

https://github.com/cel-expr/cel-go/pull/1302 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83530... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-83530 Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2026-83530 Vendor Advisory
https://ubuntu.com/security/CVE-2026-83530 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-83530 Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-789Memory Allocation with Excessive Size Value

Timeline

Published9 Sep 2026

Updated26 Oct 2026

First seen9 Sep 2026

Sources

CVE-2026-83530 · NVD

CVE-2026-83530 · MITRE

CVE-2026-83530 · OSV

DEBIAN-CVE-2026-83530 · OSV

UBUNTU-CVE-2026-83530 · OSV

Track software like this

Free during beta