Cel Go
Monthly
Uncontrolled memory allocation in cel-go, Google's Go implementation of the Common Expression Language, allows remote unauthenticated attackers to trigger heap allocation proportional to the size of a submitted expression before the configured ParserExpressionSizeLimit is checked or enforced. Affected are all versions of cpe:2.3:a:google:cel-go:*:*:*:*:*:*:*:* whose Compile() and Parse() code paths call the pre-fix NewTextSource() without first bounding the input length. No public exploit code exists and this vulnerability has not been added to CISA KEV, but the trivially automatable nature of the attack makes it a meaningful denial-of-service risk for any service that exposes a CEL evaluation endpoint to user input.
Uncontrolled memory allocation in cel-go, Google's Go implementation of the Common Expression Language, allows remote unauthenticated attackers to trigger heap allocation proportional to the size of a submitted expression before the configured ParserExpressionSizeLimit is checked or enforced. Affected are all versions of cpe:2.3:a:google:cel-go:*:*:*:*:*:*:*:* whose Compile() and Parse() code paths call the pre-fix NewTextSource() without first bounding the input length. No public exploit code exists and this vulnerability has not been added to CISA KEV, but the trivially automatable nature of the attack makes it a meaningful denial-of-service risk for any service that exposes a CEL evaluation endpoint to user input.