Every CVESearch/Get API key

CVE-2026-83530

Uncontrolled Memory Allocation in cel-go

6.9 MediumFix available

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.16%Unchanged since Sep 10, 2026
90%50%10%1%

What each source reports

CVE List Score used6.9

Uncontrolled Memory Allocation in cel-go

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.

Record
CVE-2026-83530
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-789
Updated
2026-11-02
EUVDEUVD-2026-750416.9

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.

Record
EUVD-2026-75041
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-c2gw-4533-c2w36.9

A user could provide an expression whose string length is longer than the...

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.

Record
GHSA-c2gw-4533-c2w3
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-789
Updated
2026-11-02
NVD6.9

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.

Record
CVE-2026-83530
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-789
Updated
2026-11-02
OSVBELL-CVE-2026-835304.3
Record
BELL-CVE-2026-83530
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSV6.9

Uncontrolled Memory Allocation in cel-go

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.

Record
CVE-2026-83530
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-789
Updated
2026-11-12
Show 12 moreShow less
OSVDEBIAN-CVE-2026-835304.3

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.

Record
DEBIAN-CVE-2026-83530
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-835306.9

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.

Record
UBUNTU-CVE-2026-83530
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVAZL-100914No score

CVE-2026-83530 affecting package cert-manager for versions less than 1.12.15-14

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.

Record
AZL-100914
Updated
2026-11-02
OSVAZL-100917No score

CVE-2026-83530 affecting package cloud-provider-kubevirt for versions less than 0.5.1-9

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.

Record
AZL-100917
Updated
2026-11-05
OSVAZL-100932No score

CVE-2026-83530 affecting package keda 2.14.1-19

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.

Record
AZL-100932
Updated
2026-11-02
OSVAZL-100935No score

CVE-2026-83530 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.

Record
AZL-100935
Updated
2026-11-02
OSVAZL-100938No score

CVE-2026-83530 affecting package kubernetes for versions less than 1.30.10-32

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.

Record
AZL-100938
Updated
2026-11-05
OSVAZL-100944No score

CVE-2026-83530 affecting package prometheus-adapter for versions less than 0.12.0-12

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.

Record
AZL-100944
Updated
2026-11-05
OSVAZL-100950No score

CVE-2026-83530 affecting package telegraf for versions less than 1.31.0-33

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.

Record
AZL-100950
Updated
2026-11-02
OSVAZL-111629No score

CVE-2026-83530 affecting package kubevirt-openvmm 1.9.0-1

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.

Record
AZL-111629
Updated
2026-11-05
OSVopenSUSE-SU-2026:11920-1No score

grafana-12.4.11-1.1 on GA media

These are all security issues fixed in the grafana-12.4.11-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11920-1
Updated
2026-11-02
OSVSUSE-SU-2026:24645-1No score

Security update for elemental, elemental-register, elemental-system-agent, elemental-toolkit

This update for elemental, elemental-register, elemental-system-agent, elemental-toolkit fixes the following issues:

  • CVE-2026-19201: github.com/google/go-attestation/attest: unbounded recursion in Windows ELAM parsing (bsc#1279911 bsc#1279912).
  • CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265781).
  • CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277992).
  • CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266622 bsc#1266789).
  • CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272088).
  • CVE-2026-79775: github.com/diskfs/go-diskfs: malformed SquashFS image can cause crashes and persistent CPU loops in rclone's archive backend (bsc#1278164).
  • CVE-2026-83530: github.com/google/cel-go/cel: no enforcement of expression size limit before source construction can lead to excessive resource consumption (bsc#1279996).
  • CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279312).
  • CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279213).

Changes for elemental-pool:

  • Update to v2.3.2:
  • 9e6df8e Update KVM flavor to include iptables

Changes for elemental-register-pool:

  • Update to v1.9.3:
  • ee57a686 Bump github.com/rancher-sandbox/go-tpm
  • 2a6c4918 Fix sporadic failures in unit tests
  • 717137bd bump yip library
  • 9c08fcac User Rewrite function instead of a Director function in ReverseProxy
  • 3073bcc1 Bump rancher-sandbox/go-tpm
  • 0746e6be Bump grpc library to v1.83.2. Includes fixes for:
  • bsc#1279213 (CVE-2026-84304)
  • 56c83652 Bump to golang 1.26
  • f37b9d62 bump go-attestation. Includes fixes for:
  • bsc#1279912 (CVE-2026-19201)
  • bsc#1279911 (CVE-2026-19201)
  • 48e0352f Bump test environment
  • f78effcf Bump generators
  • 6c7818a2 Bump wrangler to v3.6.1. Includes fixes for:
  • bsc#1272088 (CVE-2026-56852)
  • bsc#1279312 (CVE-2026-84303)
  • bsc#1266789 (CVE-2026-39821)
  • bsc#1266622 (CVE-2026-39821)
  • 0eeb3eac Bump grpc-ecosystem/grpc-gateway/v2. Includes fixes for:
  • bsc#1277992 (CVE-2026-37236)
  • 0c104e17 fix(tpm): fix duplicate emulated TPM seeds on UUID suffix collision (#1018)
  • 3605ef3f Change tags order to facilitate OBS builds
  • Changes on top of v1.9.2:
  • 893fbf0f Fix reference in labels
  • dfaf68ac Adapt labels to pass OBS container checks

Changes for elemental-system-agent-pool:

  • Update to version 0.15.2:
  • fix: swap kubectl download to cowboy-builder rpm
  • Update module golang.org/x/crypto to v0.56.0 [SECURITY]
  • Update module google.golang.org/grpc to v1.83.2 [SECURITY]
  • Update module golang.org/x/mod to v0.40.0 [SECURITY]
  • Update module github.com/google/cel-go to v0.30.0 [SECURITY]
  • Update module go.etcd.io/etcd/client/pkg/v3 to v3.6.14 [SECURITY]
  • Update module github.com/klauspost/compress to v1.18.7 [SECURITY] This version includes fixes for:
  • bsc#1279996 (CVE-2026-83530)
  • bsc#1279312 (CVE-2026-84303)
  • bsc#1279213 (CVE-2026-84304)
  • Update to version 0.15.1:
  • [2.15] Bump go toolchain to 1.26.7 (#426)
  • Bump dependencies (#421)
  • Update README (#404)
  • add uninstall flag (#384)
  • some cve fixes, notably x/net and kubectl versions (#359)
  • Update actions/checkout action to v7
  • Update actions/upload-artifact action to v7
  • Update actions/setup-go action to v6.4.0
  • Update rancher/renovate-config digest to fc79cf4
  • Update registry.suse.com/bci/bci-micro Docker tag to v16
  • switch renovate over to the newer configuration (#293)
  • bump kubectl to 1.36.1 (#292)
  • add release branches…
Record
SUSE-SU-2026:24645-1
Updated
2026-11-12

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cert-manager
Azure Linux:3
before 1.12.15-14
1.12.15-14
cloud-provider-kubevirt
Azure Linux:3
before 0.5.1-9
0.5.1-9
keda
Azure Linux:3
through 2.14.1-19None known
kube-vip-cloud-provider
Azure Linux:3
before 0.0.10-10
0.0.10-10
kubernetes
Azure Linux:3
before 1.30.10-32
1.30.10-32
prometheus-adapter
Azure Linux:3
before 0.12.0-12
0.12.0-12
telegraf
Azure Linux:3
before 1.31.0-33
1.31.0-33
kubevirt-openvmm
Azure Linux:3
through 1.9.0-1None known
kubernetes
Alpaquita:25
1.35.0-r1 and laterNone known
calicoctl
Alpaquita:stream
3.31.3-r0 up to 3.33.0-r0
3.33.0-r0
Show 12 moreShow less
Affected packages
PackageAffectedFixed
kubernetes
Alpaquita:stream
1.35.0-r1 up to 1.37.0-r0
1.37.0-r0
golang-cel-cel-go
Debian:14
before 0.32.0+ds-1
0.32.0+ds-1
golang-github-google-cel-go
Debian:13
All versions, plus listed versions
0.18.2+ds-50.18.2+ds-60.18.2+ds-70.27.0+ds-10.27.0+ds-1~exp1
Show 9 moreShow less
0.27.0+ds-20.27.0+ds-30.27.0+ds-3~bpo13+10.27.0+ds-3~bpo13+20.27.0+ds-40.27.0+ds-50.27.0+ds-60.27.0+ds-70.30.0+ds-1
None known
golang-github-google-cel-go
Debian:14
before 0.30.0+ds-1, plus listed versions
0.18.2+ds-50.18.2+ds-60.18.2+ds-70.27.0+ds-10.27.0+ds-1~exp1
Show 8 moreShow less
0.27.0+ds-20.27.0+ds-30.27.0+ds-3~bpo13+10.27.0+ds-3~bpo13+20.27.0+ds-40.27.0+ds-50.27.0+ds-60.27.0+ds-7
0.30.0+ds-1
elemental
SUSE:Linux Micro 6.2
From an advisory covering 9 CVEs
before 2.3.2-160000.1.1
2.3.2-160000.1.1
elemental-register
SUSE:Linux Micro 6.2
From an advisory covering 9 CVEs
before 1.9.3-160000.1.1
1.9.3-160000.1.1
elemental-system-agent
SUSE:Linux Micro 6.2
From an advisory covering 9 CVEs
before 0.15.2-160000.1.1
0.15.2-160000.1.1
elemental-toolkit
SUSE:Linux Micro 6.2
From an advisory covering 9 CVEs
before 2.3.5-160000.1.1
2.3.5-160000.1.1
golang-github-google-cel-go
Ubuntu:24.04:LTS
All versions, plus listed versions
0.12.5+ds-1
None known
golang-github-google-cel-go
Ubuntu:26.10
All versions, plus listed versions
0.27.0+ds-10.27.0+ds-30.27.0+ds-4
None known
golang-github-google-cel-go
Ubuntu:26.04:LTS
All versions, plus listed versions
0.18.2+ds-50.18.2+ds-70.27.0+ds-1
None known
grafana
openSUSE:Tumbleweed
From an advisory covering 8 CVEs
before 12.4.11-1.1
12.4.11-1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-83530 is a medium vulnerability (CVSS 6.9) in Google Cel-go, published September 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 5th percentile. Fixed in cert-manager 1.12.15-14.

References

Show 28 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open