CVE-2026-83530 Overview
CVE-2026-83530 affects the Common Expression Language (CEL) Go implementation (cel-go). The parser allocates memory proportional to input size before validating the expression against the configured ParserExpressionSizeLimit(). An unauthenticated attacker can submit an oversized expression string and force the CEL environment to allocate memory prior to the size-limit enforcement. This weakness maps to [CWE-789: Memory Allocation with Excessive Size Value] and enables a denial-of-service condition against services that evaluate untrusted CEL expressions.
Critical Impact
Remote, unauthenticated attackers can trigger disproportionate memory allocations in CEL-Go embedding applications, degrading availability of Kubernetes admission controllers, policy engines, and other CEL consumers.
Affected Products
- cel-go (Google Common Expression Language for Go)
- Applications embedding cel-go with a configured ParserExpressionSizeLimit()
- Downstream projects consuming CEL for policy evaluation (for example, Kubernetes admission and validation workflows)
Discovery Timeline
- 2026-09-09 - CVE-2026-83530 published to the National Vulnerability Database
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-83530
Vulnerability Analysis
The cel-go parser exposes ParserExpressionSizeLimit() so embedders can bound the size of expressions accepted from untrusted sources. The limit is intended to protect the runtime from pathological inputs. In the affected versions, the parser allocates buffers sized to the incoming expression string before the limit check runs. The allocation therefore scales with the attacker-controlled input length rather than the configured ceiling.
This pattern defeats the protection the size limit was designed to provide. A caller that assumes the limit is enforced up-front can still be pushed into large heap allocations. Repeated requests amplify the memory pressure and can lead to service instability or out-of-memory termination of the host process.
Root Cause
The root cause is an ordering defect in input validation. The parser performs allocation work proportional to len(input) before consulting ParserExpressionSizeLimit(). The size check must occur before any allocation whose cost scales with the untrusted input.
Attack Vector
Exploitation requires network access to an endpoint that forwards user-supplied strings into cel.Parse or equivalent APIs. No authentication, privileges, or user interaction are needed. The attacker sends an expression whose length exceeds the configured limit, and the process allocates memory proportional to the payload before rejecting it. Refer to the upstream fix in cel-go Pull Request #1302 for the corrected validation order.
Detection Methods for CVE-2026-83530
Indicators of Compromise
- Sudden spikes in resident memory usage of processes embedding cel-go without a corresponding increase in successful request volume
- Repeated parser errors referencing expression size limits in application logs
- Out-of-memory (OOM) kills or restarts of services that expose CEL evaluation endpoints
Detection Strategies
- Inspect application logs for high-frequency ParserExpressionSizeLimit rejections originating from a narrow set of source addresses
- Correlate inbound request payload sizes with heap growth on services that accept user-supplied CEL expressions
- Alert on repeated large request bodies to admission controllers, policy engines, or API endpoints that evaluate CEL
Monitoring Recommendations
- Track Go runtime metrics (go_memstats_alloc_bytes, GC pauses) on CEL-consuming services and baseline normal operation
- Enable request-size logging on ingress proxies fronting policy or admission services
- Forward parser error telemetry to a centralized analytics platform for cross-service correlation
How to Mitigate CVE-2026-83530
Immediate Actions Required
- Upgrade cel-go to the fixed release that incorporates Pull Request #1302 and rebuild downstream binaries
- Inventory services that call cel.Parse on untrusted input and prioritize patching internet-exposed endpoints
- Enforce request-body size limits at ingress proxies to cap payloads before they reach the parser
Patch Information
The upstream fix reorders input validation so the configured ParserExpressionSizeLimit() is enforced before any allocation proportional to the input. Apply the release containing cel-go PR #1302 and update the go.mod dependency across all consuming services.
Workarounds
- Terminate oversized requests at an upstream reverse proxy or API gateway using a strict max_request_body_size policy
- Wrap CEL parsing calls with an application-level len(expression) check that rejects inputs above the configured limit before invoking the parser
- Rate-limit and authenticate endpoints that expose CEL evaluation to reduce anonymous abuse surface
# Update cel-go dependency to a fixed release
go get github.com/google/cel-go@latest
go mod tidy
go build ./...
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
