CVE-2026-83530
A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.
- Published Sep 9, 2026
- CVSS 6.9 medium
- 0.1% chance of exploitation in the next 30 days (EPSS)
- A fix is available