AIKIDO-2026-593954
cel is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
celTL;DR
The CEL parser is built on an ANTLR ALL(*) adaptive-prediction engine that performs unbounded error recovery when it encounters malformed input. A short adversarial expression of roughly a hundred bytes drives near-exponential growth in the parser's prediction DFA and configuration sets, consuming gigabytes of memory. A service that compiles untrusted CEL expressions can be driven out of memory and terminated by a tiny request, and expression length limits do not mitigate it because the amplification factor is enormous. The fix caps parser error-recovery attempts and aborts parsing once a configurable limit is exceeded.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application compiles or validates CEL expressions built from untrusted input.
Background info
cel is vulnerable to Denial of Service (DoS) in versions 0.10.0 - 0.14.2.
How to fix this
Upgrade the cel library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant