This vulnerability arises when the CEL environment processes an expression string exceeding the ParserExpressionSizeLimit(). Although the limit is intended to restrict expression size, the system allocates memory proportional to the oversized input before enforcing the limit, potentially leading to inefficient memory use. The CVSS vector indicates the attack requires network access with low complexity and low privileges, no user interaction, and impacts integrity without affecting confidentiality or availability.

The vulnerability may allow an attacker with network access and low privileges to cause memory allocation proportional to an oversized expression string, potentially leading to resource exhaustion or degraded performance. There is no direct impact on confidentiality or availability, and no known exploits are reported in the wild.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting user input size at application level or monitoring for unusually large expressions to mitigate potential resource exhaustion.