This vulnerability in Google cel-go involves memory allocation with an excessive size value. When a user provides an expression whose string length exceeds the ParserExpressionSizeLimit() configured in the CEL environment, the system allocates memory proportional to the input size before checking or enforcing the limit. This behavior can lead to excessive memory consumption, classified under CWE-789 (Memory Allocation with Excessive Size Value). The CVSS 4.0 base score is 6.9, indicating medium severity. No patch or remediation guidance is currently available, and there are no known exploits in the wild.

The impact is limited to potential excessive memory allocation, which could degrade system performance or cause denial of service due to resource exhaustion. There is no indication of privilege escalation, code execution, or data disclosure. The vulnerability can be triggered remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider limiting exposure to untrusted input or applying resource usage monitoring to detect abnormal memory consumption related to CEL expression parsing.