Your message dated Fri, 09 Oct 2026 01:49:20 +0000
with message-id <[email protected]>
and subject line Bug#1147513: fixed in golang-github-google-cel-go 0.30.0+ds-1
has caused the Debian Bug report #1147513,
regarding golang-github-google-cel-go: CVE-2026-83530
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1147513: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1147513
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: golang-github-google-cel-go
Version: 0.27.0+ds-6
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for golang-github-google-cel-go.
AFAIU, is this source package replaced by golang-cel-cel-go which
already contains the fix and should golang-github-google-cel-go be
removed? This is as well the reason to make a RC level issue here.
CVE-2026-83530[0]:
| A user could provide an expression whose string length is longer
| than the ParserExpressionSizeLimit() configured on the CEL
| environment, and a memory allocation would occur proportional to the
| size of the input before the limit would be checked / enforced.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-83530
https://www.cve.org/CVERecord?id=CVE-2026-83530
[1] https://github.com/cel-expr/cel-go/pull/1302
[2]
https://github.com/cel-expr/cel-go/commit/2814acd9e1edc48811cbd88c6f60432638334e5a
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: golang-github-google-cel-go
Source-Version: 0.30.0+ds-1
Done: Arthur Diniz <[email protected]>
We believe that the bug you reported is fixed in the latest version of
golang-github-google-cel-go, which is due to be installed in the Debian FTP
archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Arthur Diniz <[email protected]> (supplier of updated
golang-github-google-cel-go package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 09 Oct 2026 01:14:11 +0100
Source: golang-github-google-cel-go
Architecture: source
Version: 0.30.0+ds-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Go Packaging Team <[email protected]>
Changed-By: Arthur Diniz <[email protected]>
Closes: 1147513
Changes:
golang-github-google-cel-go (0.30.0+ds-1) unstable; urgency=medium
.
* Team upload.
.
[ Santiago Vila ]
* New upstream release.
* Should fix CVE-2026-83530. Closes: #1147513.
* Disable redundant/duplicate Salsa CI jobs.
.
[ Arthur Diniz]
* d/patches: Fix list cost estimators and int tests on 32-bit arches
* d/rules: Skip timing-sensitive TestConcurrentEval subtests
Checksums-Sha1:
a678db5bf1602565efa244841d475bcbd279e6a8 2561
golang-github-google-cel-go_0.30.0+ds-1.dsc
0250f215df537da590252928c36eaaa4a11416e1 611652
golang-github-google-cel-go_0.30.0+ds.orig.tar.xz
4815c3a756b821274ca6694e0447069c953dc477 7336
golang-github-google-cel-go_0.30.0+ds-1.debian.tar.xz
6a0c996208e27ca03e9ff7ab024f4d07b4e3415c 14176
golang-github-google-cel-go_0.30.0+ds-1_amd64.buildinfo
Checksums-Sha256:
666ea1b381a2832ac5e2f80f9ebc32ef27fd9a995f873727f06f277d8621c6cb 2561
golang-github-google-cel-go_0.30.0+ds-1.dsc
d9604588ed0fa83cb2a210d0c63d8fc0ec3e20ab6e7b24acc0cfcd62eda6aad7 611652
golang-github-google-cel-go_0.30.0+ds.orig.tar.xz
3af56a35c7b32c6a078776494f5c7c9ef6a46de7c5dea4f2f1609b4a691c307f 7336
golang-github-google-cel-go_0.30.0+ds-1.debian.tar.xz
dede0be8e9be1fe210580bce738f05ce3bd565163ce63f172f96b0b8c19d756f 14176
golang-github-google-cel-go_0.30.0+ds-1_amd64.buildinfo
Files:
43557d2b8eb4753dca7f8916796e846f 2561 golang optional
golang-github-google-cel-go_0.30.0+ds-1.dsc
164e90ced175eda5c789f239812de81d 611652 golang optional
golang-github-google-cel-go_0.30.0+ds.orig.tar.xz
211cb4c7769dad496e4cf7d5db1e8c7c 7336 golang optional
golang-github-google-cel-go_0.30.0+ds-1.debian.tar.xz
ec0531c40b0cc4e64df765d021bf31a7 14176 golang optional
golang-github-google-cel-go_0.30.0+ds-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJIBAEBCgAyFiEECOt4p/pKieBdXIaey86ybZa5jLsFAmrIQ6gUHGFydGh1cmJk
QGRlYmlhbi5vcmcACgkQy86ybZa5jLuGPA//ZJh/cqDTpoDiqlJCqZ6CTscyvkCu
UuXvG/SqgaoB6RS/jDOTHmR318F9T9SOm1Xdad6AY+yTb5EaGd/gg9QW7t0oxGlh
89IsGmge6LmXo6bFKAPNvkED273xsNMhfO1chnyCOGy2aTbWh5hcmOxvLVdo0BR8
+ScqbPhq2vedXIeZieVMqjp/nOuxyIlk15rqdsguBRrlwqyQVIxTqYePikSmAe0W
Bho/nWYH6nzCQgWze5fqitDtNaNWH3ASFp0LnlWKRNx049WTlzDYMZISArdZbQWC
twJ/A25Pzf4K2p1HCbUSUd9XRTkzSXkCBDbgB0WoDd0kEqYtK5tFvaoY3pss7LuR
kDeAqjsqA8aijl3leb0QIlu5lFE7QtKazK4iTvRleQGpjWUbaqTFZvNe8tSTetsg
R8IplQFJfPUXnkQkjXr8yfLaEN7cAMU3ucDXOA1N1AE9YNA6tCgU9y5eHkWer76e
cOF661HxEb+u9ZKrj8Z5BVtsmpsD7sImwng9XlOh2zw1A0tziDH7MyPjCPClapiq
bDcd5fBX72OgJMzAwN+EtWY//qz5c7x6znhe+k+O/B2iujKDTLBXWhbtw+VW5soW
LxxM6PLjprBrTyMVUVUSBw6y0x/3hdOhnEVNvMTWRQaHqjvb+0uDxOrEgaZpCP99
KquFT0vmr1RdCWY=
=cuTV
-----END PGP SIGNATURE-----
pgp2B8kJQ3LH5.pgp
Description: PGP signature
--- End Message ---
