Description
A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| cel-go | < 0.29.0 | 0.29.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-cel-cel-go | 0.32.0+ds-1 | — |
| Debian 14 | golang-github-google-cel-go | 0.30.0+ds-1 | — |
| Debian 13 | golang-github-google-cel-go | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-github-google-cel-go | No fix yet | — |
| Ubuntu 26.04 LTS | golang-github-google-cel-go | No fix yet | — |
| Ubuntu 24.04 LTS | golang-github-google-cel-go | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.2 | elemental | 2.3.2-160000.1.1 | SUSE-SU-2026:24645-1 |
| SLE Micro 6.2 | elemental-register | 1.9.3-160000.1.1 | SUSE-SU-2026:24645-1 |
| SLE Micro 6.2 | elemental-system-agent | 0.15.2-160000.1.1 | SUSE-SU-2026:24645-1 |
| SLE Micro 6.2 | elemental-toolkit | 2.3.5-160000.1.1 | SUSE-SU-2026:24645-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | grafana | 12.4.11-1.1 | openSUSE-SU-2026:11920-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cert-manager | 1.12.15-14 | — |
| Azure Linux 3 | cloud-provider-kubevirt | 0.5.1-9 | — |
| Azure Linux 3 | keda +1 | No fix yet | — |
| Azure Linux 3 | kube-vip-cloud-provider | 0.0.10-10 | — |
| Azure Linux 3 | kubernetes | 1.30.10-32 | — |
| Azure Linux 3 | prometheus-adapter | 0.12.0-12 | — |
| Azure Linux 3 | telegraf | 1.31.0-33 | — |
Advisories 2
- SUSE-SU-2026:24645-1 Security update for elemental, elemental-register, elemental-system-agent, elemental-toolkit SUSE / openSUSE Security Updates · Nov 12, 2026
- openSUSE-SU-2026:11920-1 grafana-12.4.11-1.1 on GA media SUSE / openSUSE Security Updates · Sep 30, 2026