Medium severity4.3NVD Advisory· Published Sep 9, 2026· Updated Sep 23, 2026

CVE-2026-83530

Description

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Cel Expr/Cel Goreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)
Google/Common Expression Language
cpe:2.3:a:google:common_expression_language:*:*:*:*:*:go:*:*
Range: <0.29.0
osv-coords
pkg:rpm/opensuse/grafana&distro=openSUSE%20Tumbleweed
Range: < 12.4.11-1.1

Patches

Vulnerability mechanics

References

github.com/cel-expr/cel-go/pull/1302nvdPatchVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000