Vulnerability · Published Oct 10, 2025 · Assigned by GitHub_M

CVE-2025-62162cel-rust May Panic During Parsing of Invalid CEL Expressions

High 7.5

In plain English

A high-severity improper input validation in cel-rust from cel-rust. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 62.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

cel-rust is a Common Expression Language interpreter written in Rust. Starting in version 0.10.0 and prior to version 0.11.4, parsing certain malformed CEL expressions can cause the parser to panic, terminating the process. When the crate is used to evaluate untrusted expressions (e.g., user-supplied input over an API), an attacker can send crafted input to trigger a denial of service (DoS). Version 0.11.4 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
cel-rust	cel-rust	>= 0.10.0, < 0.11.4

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/cel-rust/cel-rust/security/advisories/GHSA-wxwx-9fh7-5mrw x_refsource_CONFIRM
https://github.com/cel-rust/cel-rust/releases/tag/cel-v0.11.4 x_refsource_MISC