CVE-2026-83530 Uncontrolled Memory Allocation in cel-go
An attacker can cause excessive memory allocation by providing oversized expressions, leading to denial of service in applications using cel-go.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-83530?
CVE-2026-83530 is a medium-severity denial of service vulnerability in Google cel-go, published on 9 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.
Weakness: CWE-789
Which versions are affected by CVE-2026-83530?
It affects 1 product.
Products include Google Common Expression Language.
How do I fix CVE-2026-83530?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-83530 being exploited?
There is no known exploitation of CVE-2026-83530 in the wild and no public exploit code.
Sources
Also known as AZL-100914, AZL-100917, AZL-100932, AZL-100935, AZL-100938, AZL-100944 and 5 more.