Skip to content
Fencer Vulns
high 7.5

CVE-2025-29786 json

Memory Exhaustion in Expr Parser with Unrestricted Input

published 2025-03-17 19 mo ago modified 2026-09-10 1 mo ago also EUVD-2025-6527 , GHSA-93mq-9ffx-83m2 , GO-2025-3525

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits
0
none known

Summary

Expr is an expression language and expression evaluation for Go. Prior to version 1.17.0, if the Expr expression parser is given an unbounded input string, it will attempt to compile the entire string and generate an Abstract Syntax Tree (AST) node for each part of the expression. In scenarios where input size isn’t limited, a malicious or inadvertent extremely large expression can consume excessive memory as the parser builds a huge AST. This can ultimately lead to*excessive memory usage and an Out-Of-Memory (OOM) crash of the process. This issue is relatively uncommon and will only manifest when there are no restrictions on the input size, i.e. the expression length is allowed to grow arbitrarily large. In typical use cases where inputs are bounded or validated, this problem would not occur. The problem has been patched in the latest versions of the Expr library. The fix introduces compile-time limits on the number of AST nodes and memory usage during parsing, preventing any single expression from exhausting resources. Users should upgrade to Expr version 1.17.0 or later, as this release includes the new node budget and memory limit safeguards. Upgrading to v1.17.0 ensures that extremely deep or large expressions are detected and safely aborted during compilation, avoiding the OOM condition. For users who cannot immediately upgrade, the recommended workaround is to impose an input size restriction before parsing. In practice, this means validating or limiting the length of expression strings that your application will accept. For example, set a maximum allowable number of characters (or nodes) for any expression and reject or truncate inputs that exceed this limit. By ensuring no unbounded-length expression is ever fed into the parser, one can prevent the parser from constructing a pathologically large AST and avoid potential memory exhaustion. In short, pre-validate and cap input size as a safeguard in the absence of the patch.

Patch / fix

  • go github.com/expr-lang/expr 1.17.0
  • expr-lang expr 1.17.0
  • opentelemetry-collector RHEL 10.0 0.107.0-9.el10_0
  • opentelemetry-collector RHEL 9 0.107.0-8.el9_6
  • opentelemetry-collector RHEL 9 0.107.0-8.el9_5
  • opentelemetry-collector RHEL 9.4 EUS 0.107.0-7.el9_4

red hat advisories RHSA-2025:7479RHSA-2025:7407RHSA-2025:3593RHSA-2025:3335

  • argocd-cli openSUSE Tumbleweed 2.14.10-1.1
  • govulncheck-vulndb openSUSE Tumbleweed 0.0.20250318T181448-1.1

opensuse advisories openSUSE-SU-2025:15006-1openSUSE-SU-2025:14910-1

  • opentelemetry-collector Rocky Linux 10 0.107.0-9.el10_0

rocky linux advisories RLSA-2025:7479

  • coredns CBL-Mariner 2.0 1.11.1-18
  • ig Azure Linux 3.0 0.37.0-3
  • keda Azure Linux 3.0 2.14.1-5
  • coredns Azure Linux 3.0 1.11.4-5

azure linux advisories AZL-58848AZL-58857AZL-58861AZL-58872

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-29786 updated cvss 7.5

github.com/expr-lang/expr: Memory Exhaustion in Expr Parser with Unrestricted Input

  • Red Hat Custom Metric Autoscaler operator for Red Hat Openshift custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9 Red Hat Deployment Validation Operator dvo/deployment-validation-rhel8-operator Red Hat OpenShift AI (RHOAI) rhoai/odh-ml-pipelines-driver-rhel8, rhoai/odh-ml-pipelines-launcher-rhel8, rhoai/odh-ml-pipelines-api-server-v2-rhel8, rhoai/odh-ml-pipelines-persistenceagent-v2-rhel8, rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel8, rhoai/odh-data-science-pipelines-argo-argoexec-rhel8, +1 more Red Hat OpenShift distributed tracing 3 rhosdt/tempo-rhel8-operator, rhosdt/opentelemetry-operator-bundle, rhosdt/opentelemetry-target-allocator-rhel8
    affected: workaround, no fix available
  • Red Hat Custom Metric Autoscaler operator for Red Hat Openshift 2.15 custom-metrics-autoscaler 2.15.1-1744845044, custom-metrics-autoscaler 2.15.1-1744845058
    fixed: vendor fix RHSA-2025:3993
  • Red Hat Enterprise Linux AppStream (v. 9) opentelemetry-collector 0.107.0-8.el9_5, opentelemetry-collector 0.107.0-8.el9_6
    fixed: vendor fix RHSA-2025:3335
  • Red Hat Enterprise Linux AppStream (v. 10) opentelemetry-collector 0.107.0-9.el10_0
    fixed: vendor fix RHSA-2025:7479
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) opentelemetry-collector 0.107.0-7.el9_4
    fixed: vendor fix RHSA-2025:3593
  • Red Hat OpenShift distributed tracing 3.5.3 rhosdt rhosdt-3.5-1744102053, rhosdt rhosdt-3.5-1744103234
    fixed: vendor fix RHSA-2025:3743
  • Red Hat OpenShift distributed tracing 3.6.0 rhosdt rhosdt-3.6-1749565051
    fixed: vendor fix RHSA-2025:9167
  • Red Hat OpenShift GitOps 1.15 openshift-gitops-1/dex-rhel8 v1.15.2-4, openshift-gitops-1/argocd-rhel8 v1.15.2-4, openshift-gitops-1/argocd-rhel9 v1.15.2-1, openshift-gitops-1/gitops-rhel8 v1.15.2-4, openshift-gitops-1/must-gather-rhel8 v1.15.2-4, openshift-gitops-1/argo-rollouts-rhel8 v1.15.2-4, +4 more
    fixed: vendor fix RHSA-2025:7753
show 3 more
  • Red Hat Custom Metric Autoscaler operator for Red Hat Openshift 2.15 custom-metrics-autoscaler 2.15.1-1744845320, custom-metrics-autoscaler 2.15.1-1744845343, custom-metrics-autoscaler 2.15.1-1744847971
    not affected: vulnerable code not present
  • Red Hat OpenShift distributed tracing 3 rhosdt/tempo-query-rhel8, rhosdt/tempo-gateway-rhel8, rhosdt/tempo-operator-bundle, rhosdt/tempo-gateway-opa-rhel8, rhosdt/tempo-jaeger-query-rhel8
    not affected: component not present
  • Red Hat OpenShift distributed tracing 3.5.3 rhosdt rhosdt-3.5-1744028971, rhosdt rhosdt-3.5-1744029015, rhosdt rhosdt-3.5-1744029052, rhosdt rhosdt-3.5-1744085155, rhosdt rhosdt-3.5-1744102118, rhosdt rhosdt-3.5-1744102141, +3 more Red Hat OpenShift distributed tracing 3.6.0 rhosdt rhosdt-3.6-1749565136, rhosdt rhosdt-3.6-1749567716, rhosdt rhosdt-3.6-1749571054
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
19 mo ago

Exploit prediction

0.63% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/expr-lang/expr
<1.17.0
1.17.0

Affected products

  • expr-lang expr

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.