CVE-2026-83530

Name	CVE-2026-83530
Description	A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
golang-cel-cel-go (PTS)	forky	0.32.0+ds-2	fixed
	sid	0.32.0+ds-3	fixed
golang-github-google-cel-go (PTS)	trixie	0.18.2+ds-5	vulnerable
	forky, sid	0.27.0+ds-6	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
golang-cel-cel-go	source	(unstable)	0.32.0+ds-1
golang-github-google-cel-go	source	(unstable)	(unfixed)

https://github.com/cel-expr/cel-go/pull/1302
Fixed by: https://github.com/cel-expr/cel-go/commit/2814acd9e1edc48811cbd88c6f60432638334e5a (v0.29.0)