CVE-2025-62162

{
  "id": "CVE-2025-62162",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-10T23:15:36.713",
  "lastModified": "2026-10-19T16:10:00.260",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "cel-rust is a Common Expression Language interpreter written in Rust. Starting in version 0.10.0 and prior to version 0.11.4, parsing certain malformed CEL expressions can cause the parser to panic, terminating the process. When the crate is used to evaluate untrusted expressions (e.g., user-supplied input over an API), an attacker can send crafted input to trigger a denial of service (DoS). Version 0.11.4 fixes the issue."
    },
    {
      "lang": "es",
      "value": "cel-rust es un intérprete de Common Expression Language escrito en Rust. A partir de la versión 0.10.0 y antes de la versión 0.11.4, el análisis de ciertas expresiones CEL malformadas puede causar que el analizador entre en pánico, terminando el proceso. Cuando la crate se utiliza para evaluar expresiones no confiables (p. ej., entrada proporcionada por el usuario a través de una API), un atacante puede enviar una entrada manipulada para desencadenar una denegación de servicio (DoS). La versión 0.11.4 soluciona el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "cel-rust",
          "product": "cel-rust",
          "versions": [
            {
              "version": ">= 0.10.0, < 0.11.4",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-14T13:43:26.615519Z",
          "id": "CVE-2025-62162",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/cel-rust/cel-rust/releases/tag/cel-v0.11.4",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/cel-rust/cel-rust/security/advisories/GHSA-wxwx-9fh7-5mrw",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/cel-rust/cel-rust/security/advisories/GHSA-wxwx-9fh7-5mrw",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}