{"id":"CVE-2025-62162","revision":null,"records":[{"revision":"d4c02bb0560242d9baabff38fa237a6b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-62162","aliases":[],"title":"cel-rust May Panic During Parsing of Invalid CEL Expressions","description":"cel-rust is a Common Expression Language interpreter written in Rust. Starting in version 0.10.0 and prior to version 0.11.4, parsing certain malformed CEL expressions can cause the parser to panic, terminating the process. When the crate is used to evaluate untrusted expressions (e.g., user-supplied input over an API), an attacker can send crafted input to trigger a denial of service (DoS). Version 0.11.4 fixes the issue.","state":0,"publishedAt":"2025-10-10T22:25:42.027+00:00","modifiedAt":"2025-10-14T14:16:20.443+00:00","affected":[{"ecosystem":"Vendor product","name":"cel-rust","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"cel-rust\",\n                    \"product\": \"cel-rust\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 0.10.0, < 0.11.4\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/cel-rust/cel-rust/security/advisories/GHSA-wxwx-9fh7-5mrw","https://github.com/cel-rust/cel-rust/releases/tag/cel-v0.11.4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-62162","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-62162","identifiers":["CVE-2025-62162"]},"retained":false,"historicalAffected":[]},{"revision":"06704a806bd7406393282ddc6a82f203","observedAt":"2026-11-07T03:27:42.802+00:00","statement":{"source":"euvd","id":"EUVD-2025-33786","aliases":["CVE-2025-62162","GHSA-wxwx-9fh7-5mrw"],"title":"cel-rust is a Common Expression Language interpreter written in Rust. Starting in version 0.10.0 and prior to version 0.11.4, parsing certain malformed CEL expressions can cause the parser to panic, terminating the process. When the crate i…","description":"cel-rust is a Common Expression Language interpreter written in Rust. Starting in version 0.10.0 and prior to version 0.11.4, parsing certain malformed CEL expressions can cause the parser to panic, terminating the process. When the crate is used to evaluate untrusted expressions (e.g., user-supplied input over an API), an attacker can send crafted input to trigger a denial of service (DoS). Version 0.11.4 fixes the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/cel-rust/cel-rust/security/advisories/GHSA-wxwx-9fh7-5mrw","https://github.com/cel-rust/cel-rust/releases/tag/cel-v0.11.4"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-33786","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 10, 2025, 10:25:42 PM","dateUpdated":"Oct 14, 2025, 2:16:20 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-33786","identifiers":["EUVD-2025-33786","CVE-2025-62162","GHSA-wxwx-9fh7-5mrw"]},"retained":false,"historicalAffected":[]},{"revision":"9a911ef9f9ca4c8c9a02c6a9cbe6afbf","observedAt":"2026-10-25T03:17:27.277+00:00","statement":{"source":"nvd","id":"CVE-2025-62162","aliases":[],"title":"cel-rust is a Common Expression Language interpreter written in Rust. Starting in version 0.10.0 and prior to version 0.11.4, parsing certain malformed CEL expressions can cause the parser to panic, terminating the process. When the crate i…","description":"cel-rust is a Common Expression Language interpreter written in Rust. Starting in version 0.10.0 and prior to version 0.11.4, parsing certain malformed CEL expressions can cause the parser to panic, terminating the process. When the crate is used to evaluate untrusted expressions (e.g., user-supplied input over an API), an attacker can send crafted input to trigger a denial of service (DoS). Version 0.11.4 fixes the issue.","state":0,"publishedAt":"2025-10-10T23:15:36.713+00:00","modifiedAt":"2026-10-19T16:10:00.26+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/cel-rust/cel-rust/releases/tag/cel-v0.11.4","https://github.com/cel-rust/cel-rust/security/advisories/GHSA-wxwx-9fh7-5mrw"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-62162","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-20"],"productCriteria":[],"sourceDates":{"published":"2025-10-10T23:15:36.713","lastModified":"2026-10-19T16:10:00.260"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-62162","identifiers":["CVE-2025-62162"]},"retained":false,"historicalAffected":[]},{"revision":"8475a1b02a10479684491cdfea44e1c3","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-wxwx-9fh7-5mrw","aliases":["CVE-2025-62162"],"title":"cel-rust May Panic During Parsing of Invalid CEL Expressions","description":"### Summary\n\nParsing certain malformed CEL expressions can cause the parser to panic, terminating the process. When the crate is used to evaluate untrusted expressions (e.g., user-supplied input over an API), an attacker can send crafted input to trigger a denial of service (DoS).\n\n### Remediation\nUpgrade to 0.11.4\n```toml\n[dependencies]\ncel = \"0.11.4\"\n```\n\n### PoC\n\n```rust\nuse cel::{Context, Program};\n\nfn main() {\n    let program = Program::compile(\"x(1,\").unwrap();\n    let context = Context::default();\n    let value = program.execute(&context).unwrap();\n    assert_eq!(value, true.into());\n}\n```\n\n```\n$ RUST_BACKTRACE=1 cargo run --bin example-simple\n   Compiling num-traits v0.2.19\n   Compiling aho-corasick v1.1.3\n   Compiling regex-syntax v0.8.5\n   Compiling arbitrary v1.4.1\n   Compiling serde v1.0.219\n   Compiling thiserror v1.0.69\n   Compiling regex-automata v0.4.9\n   Compiling chrono v0.4.41\n   Compiling regex v1.11.1\n   Compiling cel v0.10.0 (/home/john/git/cel-rust/cel)\n\nwarning: `cel` (lib) generated 15 warnings\n   Compiling example v0.1.0 (/home/john/git/cel-rust/example)\n    Finished `dev` profile [unoptimized + debuginfo] target(s) in 2.97s\n     Running `target/debug/example-simple`\n\nthread 'main' panicked at /home/john/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/antlr4rust-0.3.0-beta3/src/tree.rs:383:9:\ninternal error: entered unreachable code: should have been properly implemented by generated context when reachable\nstack backtrace:\n   0: __rustc::rust_begin_unwind\n   1: core::panicking::panic_fmt\n   2: antlr4rust::tree::Visitable::accept\n   3: <cel::parser::gen::celparser::UnaryContextAll as antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor>>::accept\n   4: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n   5: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n   6: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n   7: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_calc\n   8: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_calc\n   9: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::CalcContextExt>>::accept\n  10: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  11: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  12: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  13: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_relation\n  14: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_relation\n  15: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::RelationContextExt>>::accept\n  16: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  17: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  18: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  19: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_conditionalAnd\n  20: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_conditionalAnd\n  21: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::ConditionalAndContextExt>>::accept\n  22: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  23: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  24: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  25: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_conditionalOr\n  26: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_conditionalOr\n  27: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::ConditionalOrContextExt>>::accept\n  28: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  29: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  30: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  31: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_expr\n  32: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_expr\n  33: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::ExprContextExt>>::accept\n  34: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  35: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  36: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  37: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_GlobalCall::{{closure}}\n  38: <core::iter::adapters::map::Map<I,F> as core::iter::traits::iterator::Iterator>::next\n  39: alloc::vec::Vec<T,A>::extend_desugared\n  40: <alloc::vec::Vec<T,A> as alloc::vec::spec_extend::SpecExtend<T,I>>::spec_extend\n  41: <alloc::vec::Vec<T> as alloc::vec::spec_from_iter_nested::SpecFromIterNested<T,I>>::from_iter\n  42: <alloc::vec::Vec<T> as alloc::vec::spec_from_iter::SpecFromIter<T,I>>::from_iter\n  43: <alloc::vec::Vec<T> as core::iter::traits::collect::FromIterator<T>>::from_iter\n  44: core::iter::traits::iterator::Iterator::collect\n  45: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_GlobalCall\n  46: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_GlobalCall\n  47: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::GlobalCallContextExt>>::accept\n  48: <cel::parser::gen::celparser::PrimaryContextAll as antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor>>::accept\n  49: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  50: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  51: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  52: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_PrimaryExpr\n  53: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_PrimaryExpr\n  54: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::PrimaryExprContextExt>>::accept\n  55: <cel::parser::gen::celparser::MemberContextAll as antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor>>::accept\n  56: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  57: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  58: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  59: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_MemberExpr\n  60: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_MemberExpr\n  61: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::MemberExprContextExt>>::accept\n  62: <cel::parser::gen::celparser::UnaryContextAll as antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor>>::accept\n  63: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  64: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  65: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  66: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_calc\n  67: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_calc\n  68: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::CalcContextExt>>::accept\n  69: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  70: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  71: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  72: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_relation\n  73: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_relation\n  74: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::RelationContextExt>>::accept\n  75: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  76: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  77: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  78: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_conditionalAnd\n  79: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_conditionalAnd\n  80: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::ConditionalAndContextExt>>::accept\n  81: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  82: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  83: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  84: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_conditionalOr\n  85: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_conditionalOr\n  86: cel::parser::gen::celparser::<impl antlr4rust::tree::Visitable<dyn cel::parser::gen::celvisitor::CELVisitor> for antlr4rust::parser_rule_context::BaseParserRuleContext<cel::parser::gen::celparser::ConditionalOrContextExt>>::accept\n  87: <dyn cel::parser::gen::celparser::CELParserContext+Ctx = cel::parser::gen::celparser::CELParserContextType+TF = antlr4rust::token_factory::CommonTokenFactory as antlr4rust::tree::VisitableDyn<T>>::accept_dyn\n  88: <T as antlr4rust::tree::VisitChildren<Node>>::visit_node\n  89: <cel::parser::parser::Parser as antlr4rust::tree::ParseTreeVisitorCompat>::visit\n  90: <cel::parser::parser::Parser as cel::parser::gen::celvisitor::CELVisitorCompat>::visit_expr\n  91: <T as cel::parser::gen::celvisitor::CELVisitor>::visit_expr\nnote: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.\n```\n\n### Impact\nUsers accepting untrusted CEL expressions","state":0,"publishedAt":"2025-10-11T01:30:53+00:00","modifiedAt":"2025-10-11T01:57:29.962335+00:00","affected":[{"ecosystem":"crates.io","name":"cel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.10.0"},{"kind":"fixed","version":"0.11.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/cel-rust/cel-rust/security/advisories/GHSA-wxwx-9fh7-5mrw","https://nvd.nist.gov/vuln/detail/CVE-2025-62162","https://github.com/cel-rust/cel-rust/commit/9df9822d81d91a3ce0fc9f712f4574a659247be3","https://github.com/cel-rust/cel-rust","https://github.com/cel-rust/cel-rust/releases/tag/cel-v0.11.4"],"sourceUrl":"https://github.com/advisories/GHSA-wxwx-9fh7-5mrw","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-wxwx-9fh7-5mrw","identifiers":["GHSA-wxwx-9fh7-5mrw","CVE-2025-62162"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T23:02:15.9754883+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T23:02:15.9754883+00:00","lastSuccessAt":"2026-11-08T23:02:16.1185375+00:00","error":null,"lastVerifiedAt":"2026-11-08T23:02:16.1185396+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-0ee53194438b774350db8ba2be9961094a7945659f4bca5c09ae0ef23c2c3f0c","complete":true,"records":421267,"lastAttemptAt":"2026-11-08T23:02:15.4905694+00:00","lastSuccessAt":"2026-11-08T23:02:15.4057062+00:00","error":null,"lastVerifiedAt":"2026-11-08T23:02:15.4905694+00:00","snapshotPublishedAt":"2026-11-08T22:18:37+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-64ec014845cf41e0b44c7812575dade1","complete":false,"records":13654,"lastAttemptAt":"2026-11-08T23:11:05.5177476+00:00","lastSuccessAt":"2026-11-08T23:11:05.509+00:00","error":null,"lastVerifiedAt":"2026-11-08T23:11:05.509+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13457,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T23:02:15.9754883+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T23:02:15.9754883+00:00","lastSuccessAt":"2026-11-08T23:02:16.1192591+00:00","error":null,"lastVerifiedAt":"2026-11-08T23:02:16.1192597+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-bbd1082fa13b4aff99c01e332b64e44f","complete":true,"records":13666,"lastAttemptAt":"2026-11-08T23:02:17.0620293+00:00","lastSuccessAt":"2026-11-08T23:02:17.059+00:00","error":null,"lastVerifiedAt":"2026-11-08T23:02:17.059+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T23:02:15.8370588+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-08T23:02:15.8370588+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T23:02:15.64043+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-08T23:02:15.64043+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-964c14035e6f0f6478b2870fad6a7ef9f6045876d4a12af2c2e514521e54b6af","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T23:02:15.942926+00:00","lastSuccessAt":"2026-11-08T11:07:12.1927025+00:00","error":null,"lastVerifiedAt":"2026-11-08T23:02:15.942926+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-f8647d7ba64b1ba0dfdc7130944766d5b36d5b77d18fff0c79e651a4cff3c2b9","complete":true,"records":231293,"lastAttemptAt":"2026-11-08T23:02:15.7372001+00:00","lastSuccessAt":"2026-11-08T11:06:56.2918717+00:00","error":null,"lastVerifiedAt":"2026-11-08T23:02:15.7372001+00:00","snapshotPublishedAt":"2026-11-08T11:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}