{"id":"GHSA-wxwx-9fh7-5mrw","summary":"cel-rust May Panic During Parsing of Invalid CEL Expressions","details":"### Summary\n\nParsing certain malformed CEL expressions can cause the parser to panic, terminating the process. When the crate is used to evaluate untrusted expressions (e.g., user-supplied input over an API), an attacker can send crafted input to trigger a denial of service (DoS).\n\n### Remediation\nUpgrade to 0.11.4\n```toml\n[dependencies]\ncel = \"0.11.4\"\n```\n\n### PoC\n\n```rust\nuse cel::{Context, Program};\n\nfn main() {\n    let program = Program::compile(\"x(1,\").unwrap();\n    let context = Context::default();\n    let value = program.execute(&context).unwrap();\n    assert_eq!(value, true.into());\n}\n```\n\n```\n$ RUST_BACKTRACE=1 cargo run --bin example-simple\n   Compiling num-traits v0.2.19\n   Compiling aho-corasick v1.1.3\n   Compiling regex-syntax v0.8.5\n   Compiling arbitrary v1.4.1\n   Compiling serde v1.0.219\n   Compiling thiserror v1.0.69\n   Compiling regex-automata v0.4.9\n   Compiling chrono v0.4.41\n   Compiling regex v1.11.1\n   Compiling cel v0.10.0 (/home/john/git/cel-rust/cel)\n\nwarning: `cel` (lib) generated 15 warnings\n   Compiling example v0.1.0 (/home/john/git/cel-rust/example)\n    Finished `dev` profile [unoptimized + debuginfo] target(s) in 2.97s\n     Running `target/debug/example-simple`\n\nthread 'main' panicked at /home/john/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/antlr4rust-0.3.0-beta3/src/tree.rs:383:9:\ninternal error: entered unreachable code: should have been properly implemented by generated context when reachable\nstack backtrace:\n   0: __rustc::rust_begin_unwind\n   1: core::panicking::panic_fmt\n   2: antlr4rust::tree::Visitable::accept\n   3: \u003ccel::parser::gen::celparser::UnaryContextAll as antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e\u003e::accept\n   4: \u003cdyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn\u003cT\u003e\u003e::accept_dyn\n   5: \u003cT as antlr4rust::tree::VisitChildren\u003cNode\u003e\u003e::visit_node\n   6: \u003ccel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat\u003e::visit\n   7: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_calc\n   8: \u003cT as cel::parser::gen::celvisitor::CELVisitor\u003e::visit_calc\n   9: cel::parser::gen::celparser::\u003cimpl antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e for antlr4rust::parser_rule_context::BaseParserRuleContext\u003ccel::parser::gen::celparser::CalcContextExt\u003e\u003e::accept\n  10: \u003cdyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn\u003cT\u003e\u003e::accept_dyn\n  11: \u003cT as antlr4rust::tree::VisitChildren\u003cNode\u003e\u003e::visit_node\n  12: \u003ccel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat\u003e::visit\n  13: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_relation\n  14: \u003cT as cel::parser::gen::celvisitor::CELVisitor\u003e::visit_relation\n  15: cel::parser::gen::celparser::\u003cimpl antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e for antlr4rust::parser_rule_context::BaseParserRuleContext\u003ccel::parser::gen::celparser::RelationContextExt\u003e\u003e::accept\n  16: \u003cdyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn\u003cT\u003e\u003e::accept_dyn\n  17: \u003cT as antlr4rust::tree::VisitChildren\u003cNode\u003e\u003e::visit_node\n  18: \u003ccel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat\u003e::visit\n  19: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_conditionalAnd\n  20: \u003cT as cel::parser::gen::celvisitor::CELVisitor\u003e::visit_conditionalAnd\n  21: cel::parser::gen::celparser::\u003cimpl antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e for antlr4rust::parser_rule_context::BaseParserRuleContext\u003ccel::parser::gen::celparser::ConditionalAndContextExt\u003e\u003e::accept\n  22: \u003cdyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn\u003cT\u003e\u003e::accept_dyn\n  23: \u003cT as antlr4rust::tree::VisitChildren\u003cNode\u003e\u003e::visit_node\n  24: \u003ccel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat\u003e::visit\n  25: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_conditionalOr\n  26: \u003cT as cel::parser::gen::celvisitor::CELVisitor\u003e::visit_conditionalOr\n  27: cel::parser::gen::celparser::\u003cimpl antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e for antlr4rust::parser_rule_context::BaseParserRuleContext\u003ccel::parser::gen::celparser::ConditionalOrContextExt\u003e\u003e::accept\n  28: \u003cdyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn\u003cT\u003e\u003e::accept_dyn\n  29: \u003cT as antlr4rust::tree::VisitChildren\u003cNode\u003e\u003e::visit_node\n  30: \u003ccel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat\u003e::visit\n  31: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_expr\n  32: \u003cT as cel::parser::gen::celvisitor::CELVisitor\u003e::visit_expr\n  33: cel::parser::gen::celparser::\u003cimpl antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e for antlr4rust::parser_rule_context::BaseParserRuleContext\u003ccel::parser::gen::celparser::ExprContextExt\u003e\u003e::accept\n  34: \u003cdyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn\u003cT\u003e\u003e::accept_dyn\n  35: \u003cT as antlr4rust::tree::VisitChildren\u003cNode\u003e\u003e::visit_node\n  36: \u003ccel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat\u003e::visit\n  37: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_GlobalCall::{{closure}}\n  38: \u003ccore::iter::adapters::map::Map\u003cI,F\u003e as core::iter::traits::iterator::Iterator\u003e::next\n  39: alloc::vec::Vec\u003cT,A\u003e::extend_desugared\n  40: \u003calloc::vec::Vec\u003cT,A\u003e as alloc::vec::spec_extend::SpecExtend\u003cT,I\u003e\u003e::spec_extend\n  41: \u003calloc::vec::Vec\u003cT\u003e as alloc::vec::spec_from_iter_nested::SpecFromIterNested\u003cT,I\u003e\u003e::from_iter\n  42: \u003calloc::vec::Vec\u003cT\u003e as alloc::vec::spec_from_iter::SpecFromIter\u003cT,I\u003e\u003e::from_iter\n  43: \u003calloc::vec::Vec\u003cT\u003e as core::iter::traits::collect::FromIterator\u003cT\u003e\u003e::from_iter\n  44: core::iter::traits::iterator::Iterator::collect\n  45: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_GlobalCall\n  46: \u003cT as cel::parser::gen::celvisitor::CELVisitor\u003e::visit_GlobalCall\n  47: cel::parser::gen::celparser::\u003cimpl antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e for antlr4rust::parser_rule_context::BaseParserRuleContext\u003ccel::parser::gen::celparser::GlobalCallContextExt\u003e\u003e::accept\n  48: \u003ccel::parser::gen::celparser::PrimaryContextAll as antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e\u003e::accept\n  49: \u003cdyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn\u003cT\u003e\u003e::accept_dyn\n  50: \u003cT as antlr4rust::tree::VisitChildren\u003cNode\u003e\u003e::visit_node\n  51: \u003ccel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat\u003e::visit\n  52: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_PrimaryExpr\n  53: \u003cT as cel::parser::gen::celvisitor::CELVisitor\u003e::visit_PrimaryExpr\n  54: cel::parser::gen::celparser::\u003cimpl antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e for antlr4rust::parser_rule_context::BaseParserRuleContext\u003ccel::parser::gen::celparser::PrimaryExprContextExt\u003e\u003e::accept\n  55: \u003ccel::parser::gen::celparser::MemberContextAll as antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e\u003e::accept\n  56: \u003cdyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn\u003cT\u003e\u003e::accept_dyn\n  57: \u003cT as antlr4rust::tree::VisitChildren\u003cNode\u003e\u003e::visit_node\n  58: \u003ccel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat\u003e::visit\n  59: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_MemberExpr\n  60: \u003cT as cel::parser::gen::celvisitor::CELVisitor\u003e::visit_MemberExpr\n  61: cel::parser::gen::celparser::\u003cimpl antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e for antlr4rust::parser_rule_context::BaseParserRuleContext\u003ccel::parser::gen::celparser::MemberExprContextExt\u003e\u003e::accept\n  62: \u003ccel::parser::gen::celparser::UnaryContextAll as antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e\u003e::accept\n  63: \u003cdyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn\u003cT\u003e\u003e::accept_dyn\n  64: \u003cT as antlr4rust::tree::VisitChildren\u003cNode\u003e\u003e::visit_node\n  65: \u003ccel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat\u003e::visit\n  66: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_calc\n  67: \u003cT as cel::parser::gen::celvisitor::CELVisitor\u003e::visit_calc\n  68: cel::parser::gen::celparser::\u003cimpl antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e for antlr4rust::parser_rule_context::BaseParserRuleContext\u003ccel::parser::gen::celparser::CalcContextExt\u003e\u003e::accept\n  69: \u003cdyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn\u003cT\u003e\u003e::accept_dyn\n  70: \u003cT as antlr4rust::tree::VisitChildren\u003cNode\u003e\u003e::visit_node\n  71: \u003ccel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat\u003e::visit\n  72: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_relation\n  73: \u003cT as cel::parser::gen::celvisitor::CELVisitor\u003e::visit_relation\n  74: cel::parser::gen::celparser::\u003cimpl antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e for antlr4rust::parser_rule_context::BaseParserRuleContext\u003ccel::parser::gen::celparser::RelationContextExt\u003e\u003e::accept\n  75: \u003cdyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn\u003cT\u003e\u003e::accept_dyn\n  76: \u003cT as antlr4rust::tree::VisitChildren\u003cNode\u003e\u003e::visit_node\n  77: \u003ccel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat\u003e::visit\n  78: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_conditionalAnd\n  79: \u003cT as cel::parser::gen::celvisitor::CELVisitor\u003e::visit_conditionalAnd\n  80: cel::parser::gen::celparser::\u003cimpl antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e for antlr4rust::parser_rule_context::BaseParserRuleContext\u003ccel::parser::gen::celparser::ConditionalAndContextExt\u003e\u003e::accept\n  81: \u003cdyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn\u003cT\u003e\u003e::accept_dyn\n  82: \u003cT as antlr4rust::tree::VisitChildren\u003cNode\u003e\u003e::visit_node\n  83: \u003ccel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat\u003e::visit\n  84: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_conditionalOr\n  85: \u003cT as cel::parser::gen::celvisitor::CELVisitor\u003e::visit_conditionalOr\n  86: cel::parser::gen::celparser::\u003cimpl antlr4rust::tree::Visitable\u003cdyn cel::parser::gen::celvisitor::CELVisitor\u003e for antlr4rust::parser_rule_context::BaseParserRuleContext\u003ccel::parser::gen::celparser::ConditionalOrContextExt\u003e\u003e::accept\n  87: \u003cdyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn\u003cT\u003e\u003e::accept_dyn\n  88: \u003cT as antlr4rust::tree::VisitChildren\u003cNode\u003e\u003e::visit_node\n  89: \u003ccel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat\u003e::visit\n  90: \u003ccel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat\u003e::visit_expr\n  91: \u003cT as cel::parser::gen::celvisitor::CELVisitor\u003e::visit_expr\nnote: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.\n```\n\n### Impact\nUsers accepting untrusted CEL expressions","aliases":["CVE-2025-62162"],"modified":"2025-10-11T01:57:29.962335Z","published":"2025-10-11T01:30:53Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2025-10-11T01:30:53Z","nvd_published_at":"2025-10-10T23:15:36Z","cwe_ids":["CWE-20"]},"references":[{"type":"WEB","url":"https://github.com/cel-rust/cel-rust/security/advisories/GHSA-wxwx-9fh7-5mrw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62162"},{"type":"WEB","url":"https://github.com/cel-rust/cel-rust/commit/9df9822d81d91a3ce0fc9f712f4574a659247be3"},{"type":"PACKAGE","url":"https://github.com/cel-rust/cel-rust"},{"type":"WEB","url":"https://github.com/cel-rust/cel-rust/releases/tag/cel-v0.11.4"}],"affected":[{"package":{"name":"cel","ecosystem":"crates.io","purl":"pkg:cargo/cel"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.10.0"},{"fixed":"0.11.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-wxwx-9fh7-5mrw/GHSA-wxwx-9fh7-5mrw.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}