A critical vulnerability in the cel-rust library allows unauthenticated remote attackers to cause a denial of service by submitting specially crafted expressions.

This vulnerability is classified as improper input validation (CWE-20). Unauthenticated attackers can trigger a process panic by sending malformed CEL expressions, leading to a denial of service.

The ability for an unauthenticated remote attacker to cause a service crash poses a significant risk to application availability. With a CVSS score of 7.5, this vulnerability represents a high risk for systems that process untrusted user input, as it can be leveraged to disrupt critical business operations or automated workflows.

Immediate Action: Update the cel-rust dependency to version 0.11.4 or later immediately.

Proactive Monitoring: Review application logs for recurring panic events or unexpected process crashes that correlate with incoming API requests.

Compensating Controls: Implement strict input validation or sanitization layers to inspect incoming CEL expressions before they are passed to the interpreter.

Public Exploit Available: Unknown.

Given the high impact on service availability and the availability of a patch, organizations should prioritize the update of the cel-rust library. Failure to address this flaw leaves systems exposed to potential service disruption. Please ensure all downstream applications utilizing this crate are recompiled with the updated version to effectively mitigate the risk.