CVE-2026-83530

MediumCVSS 4.3/10Last modified Sep 23, 2026

Description

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-789

Affected software

Vendor	Product	Versions
Google	cel-go	< 0.29.0

References

https://github.com/cel-expr/cel-go/pull/1302Patch, Vendor Advisory

Timeline

Published: Sep 9, 2026
Last modified: Sep 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-835318.8Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statem CVE-2026-835326.8The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them CVE-2026-835335.3The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an or CVE-2026-835346.4PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize_database_parallel() function that allows the owner of a table to run ar CVE-2026-835357.4A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer S CVE-2026-835365.3A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such CVE-2026-835375.3The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an or CVE-2026-835385.3Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal b CVE-2026-835397.4Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.basic.SmartLinkLabel CVE-2026-83546.4The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pop_tag' parameter in all versions up CVE-2026-835408.8When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated CVE-2026-835416.8The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properly escape a Table widget setting before outputting it within