CVE-2025-62162

cel-rust is a Common Expression Language interpreter written in Rust. Starting in version 0.10.0 and prior to version 0.11.4, parsing certain malformed CEL expressions can cause the parser to panic, terminating the process. When the crate is used to evaluate untrusted expressions (e.g., user-supplied input over an API), an attacker can send crafted input to trigger a denial of service (DoS). Version 0.11.4 fixes the issue.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/cel-rust/cel-rust/releases/tag/cel-v0.11.4
https://github.com/cel-rust/cel-rust/security/advisories/GHSA-wxwx-9fh7-5mrw
https://github.com/cel-rust/cel-rust/security/advisories/GHSA-wxwx-9fh7-5mrw

Configurations

No configuration.

History

19 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) cel-rust es un intérprete de Common Expression Language escrito en Rust. A partir de la versión 0.10.0 y antes de la versión 0.11.4, el análisis de ciertas expresiones CEL malformadas puede causar que el analizador entre en pánico, terminando el proceso. Cuando la crate se utiliza para evaluar expresiones no confiables (p. ej., entrada proporcionada por el usuario a través de una API), un atacante puede enviar una entrada manipulada para desencadenar una denegación de servicio (DoS). La versión 0.11.4 soluciona el problema.

Information

Published : 2025-10-10 23:15

Updated : 2026-10-19 16:10

NVD link : CVE-2025-62162

Mitre link : CVE-2025-62162

CVE.ORG link : CVE-2025-62162

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2025-62162", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62162", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-14T13:43:26.615519Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "cel-rust", "product": "cel-rust", "versions": [{"status": "affected", "version": ">= 0.10.0, < 0.11.4"}]}]}], "published": "2025-10-10T23:15:36.713", "references": [{"url": "https://github.com/cel-rust/cel-rust/releases/tag/cel-v0.11.4", "source": "security-advisories@github.com"}, {"url": "https://github.com/cel-rust/cel-rust/security/advisories/GHSA-wxwx-9fh7-5mrw", "source": "security-advisories@github.com"}, {"url": "https://github.com/cel-rust/cel-rust/security/advisories/GHSA-wxwx-9fh7-5mrw", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "cel-rust is a Common Expression Language interpreter written in Rust. Starting in version 0.10.0 and prior to version 0.11.4, parsing certain malformed CEL expressions can cause the parser to panic, terminating the process. When the crate is used to evaluate untrusted expressions (e.g., user-supplied input over an API), an attacker can send crafted input to trigger a denial of service (DoS). Version 0.11.4 fixes the issue."}, {"lang": "es", "value": "cel-rust es un int\u00e9rprete de Common Expression Language escrito en Rust. A partir de la versi\u00f3n 0.10.0 y antes de la versi\u00f3n 0.11.4, el an\u00e1lisis de ciertas expresiones CEL malformadas puede causar que el analizador entre en p\u00e1nico, terminando el proceso. Cuando la crate se utiliza para evaluar expresiones no confiables (p. ej., entrada proporcionada por el usuario a trav\u00e9s de una API), un atacante puede enviar una entrada manipulada para desencadenar una denegaci\u00f3n de servicio (DoS). La versi\u00f3n 0.11.4 soluciona el problema."}], "lastModified": "2026-10-19T16:10:00.260", "sourceIdentifier": "security-advisories@github.com"}