A vulnerability allows a user to submit a CEL expression whose string length exceeds the configured ParserExpressionSizeLimit(), causing the library to allocate memory in proportion to the expression size before the limit is enforced. The result is an uncontrolled memory allocation that can exhaust host resources and lead to a denial of service. The weakness is characterized as an uncontrolled allocation flaw (CWE-789).

The affected product is Google’s cel-go library. No specific version information is supplied, so any version of cel-go that does not implement length checks before allocation may be vulnerable. Organizations using cel-go in any code path that accepts user‑supplied expressions are at risk.

The CVSS score of 6.9 reflects moderate risk, and the lack of an EPSS score indicates insufficient data on actual exploitation. The vulnerability is not listed in CISA’s KEV catalog, implying no publicly known exploits. The likely attack vector is through application code that processes user‑provided CEL expressions, where an attacker can intentionally craft a very long expression to trigger excessive memory allocation. Because the allocation occurs before validation, the exploit is straightforward whenever a large expression is accepted.