CVE catalog

CVE-2026-83530

DEBIAN-CVE-2026-83530

Severity: Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: Sep 9, 2026, 2:56:22 PM UTC
Updated: Oct 12, 2026, 10:00:12 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.16% · Oct 25, 2026

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	golang-cel-cel-go	14	`0.32.0+ds-1`	fixed
Debian	golang-github-google-cel-go	13	`0.18.2+ds-5`	vulnerable
Debian	golang-github-google-cel-go	13	`0.18.2+ds-6`	vulnerable
Debian	golang-github-google-cel-go	13	`0.18.2+ds-7`	vulnerable
Debian	golang-github-google-cel-go	13	`0.27.0+ds-1`	vulnerable
Debian	golang-github-google-cel-go	13	`0.27.0+ds-1~exp1`	vulnerable
Debian	golang-github-google-cel-go	13	`0.27.0+ds-2`	vulnerable
Debian	golang-github-google-cel-go	13	`0.27.0+ds-3`	vulnerable
Debian	golang-github-google-cel-go	13	`0.27.0+ds-3~bpo13+1`	vulnerable
Debian	golang-github-google-cel-go	13	`0.27.0+ds-3~bpo13+2`	vulnerable
Debian	golang-github-google-cel-go	13	`0.27.0+ds-4`	vulnerable
Debian	golang-github-google-cel-go	13	`0.27.0+ds-5`	vulnerable
Debian	golang-github-google-cel-go	13	`0.27.0+ds-6`	vulnerable
Debian	golang-github-google-cel-go	13	`0.27.0+ds-7`	vulnerable
Debian	golang-github-google-cel-go	13	`0.30.0+ds-1`	vulnerable
Debian	golang-github-google-cel-go	14	`0.18.2+ds-5`	vulnerable
Debian	golang-github-google-cel-go	14	`0.18.2+ds-6`	vulnerable
Debian	golang-github-google-cel-go	14	`0.18.2+ds-7`	vulnerable
Debian	golang-github-google-cel-go	14	`0.27.0+ds-1`	vulnerable
Debian	golang-github-google-cel-go	14	`0.27.0+ds-1~exp1`	vulnerable
Debian	golang-github-google-cel-go	14	`0.27.0+ds-2`	vulnerable
Debian	golang-github-google-cel-go	14	`0.27.0+ds-3`	vulnerable
Debian	golang-github-google-cel-go	14	`0.27.0+ds-3~bpo13+1`	vulnerable
Debian	golang-github-google-cel-go	14	`0.27.0+ds-3~bpo13+2`	vulnerable
Debian	golang-github-google-cel-go	14	`0.27.0+ds-4`	vulnerable
Debian	golang-github-google-cel-go	14	`0.27.0+ds-5`	vulnerable
Debian	golang-github-google-cel-go	14	`0.27.0+ds-6`	vulnerable
Debian	golang-github-google-cel-go	14	`0.27.0+ds-7`	vulnerable
Debian	golang-github-google-cel-go	14	`0.30.0+ds-1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	golang-cel-cel-go	deb	14	`0.32.0+ds-1`	Not reported	DEBIAN-CVE-2026-83530	Not reported
Debian	golang-github-google-cel-go	deb	14	`0.30.0+ds-1`	Not reported	DEBIAN-CVE-2026-83530	Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

[golang-github-google-cel-go-dev]Affected
Source package: [golang-github-google-cel-go]
Details (4)
- 0.18.2+ds-5 · all · trixie
  Affected
  pypi · golang-github-google-cel-go · debian · 13
- 0.18.2+ds-5 · all · trixie
  Affected
  pypi · golang-github-google-cel-go · debian · 13
- 0.27.0+ds-3~bpo13+2 · all · trixie-backports
  Affected
  pypi · golang-github-google-cel-go · debian · 13
- 0.27.0+ds-3~bpo13+2 · all · trixie-backports
  Affected
  pypi · golang-github-google-cel-go · debian · 13

Observed: Oct 23, 2026, 9:28:51 PM UTC

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]