high 7.5

CVE-2025-68156 json

Expr has Denial of Service via Unbounded Recursion in Builtin Functions

published 2025-12-16 10 mo ago modified 2026-10-13 27 d ago also GHSA-cfpf-hrx2-8rv6 , GO-2025-4245 , EUVD-2025-203831

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 36%
public exploits: 0; none known

Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including `flatten`, `min`, `max`, `mean`, and `median`, perform recursive traversal over user-provided data structures without enforcing a maximum recursion depth. If the evaluation environment contains deeply nested or cyclic data structures, these functions may recurse indefinitely until exceed the Go runtime stack limit. This results in a stack overflow panic, causing the host application to crash. While exploitability depends on whether an attacker can influence or inject cyclic or pathologically deep data into the evaluation environment, this behavior represents a denial-of-service (DoS) risk and affects overall library robustness. Instead of returning a recoverable evaluation error, the process may terminate unexpectedly. In affected versions, evaluation of expressions that invoke certain builtin functions on untrusted or insufficiently validated data structures can lead to a process-level crash due to stack exhaustion. This issue is most relevant in scenarios where Expr is used to evaluate expressions against externally supplied or dynamically constructed environments; cyclic references (directly or indirectly) can be introduced into arrays, maps, or structs; and there are no application-level safeguards preventing deeply nested input data. In typical use cases with controlled, acyclic data, the issue may not manifest. However, when present, the resulting panic can be used to reliably crash the application, constituting a denial of service. The issue has been fixed in the v1.17.7 versions of Expr. The patch introduces a maximum recursion depth limit for affected builtin functions. When this limit is exceeded, evaluation aborts gracefully and returns a descriptive error instead of panicking. Additionally, the maximum depth can be customized by users via `builtin.MaxDepth`, allowing applications with legitimate deep structures to raise the limit in a controlled manner. Users are strongly encouraged to upgrade to the patched release, which includes both the recursion guard and comprehensive test coverage to prevent regressions. For users who cannot immediately upgrade, some mitigations are recommended. Ensure that evaluation environments cannot contain cyclic references, validate or sanitize externally supplied data structures before passing them to Expr, and/or wrap expression evaluation with panic recovery to prevent a full process crash (as a last-resort defensive measure). These workarounds reduce risk but do not fully eliminate the issue without the patch.

Patch / fix

fixed in 2 distros 6 links 2

go github.com/expr-lang/expr 1.17.7
expr-lang expr 1.17.7

red hat suse opensuse almalinux rocky linux azure linux

opentelemetry-collector RHEL 9 0.135.0-2.el9_7
opentelemetry-collector RHEL 10.1 0.135.0-2.el10_1
opentelemetry-collector RHEL 9.6 EUS 0.135.0-2.el9_6
opentelemetry-collector enterprise linux eus 10.0 0.135.0-2.el10_0
opentelemetry-collector RHEL 9.4 EUS 0.135.0-2.el9_4

red hat advisories RHSA-2026:0513 RHSA-2026:0514 RHSA-2026:0512 RHSA-2025:23729 RHSA-2025:23664

grafana SLE Module for Package Hub 15 SP7, openSUSE Leap 15.6 11.6.11-150200.3.83.1
grafana Manager Client Tools 15 11.6.11-150000.1.90.1
spacecmd openSUSE Leap 15.6, Manager Client Tools 15 5.0.15-150000.3.142.1
uyuni-tools Manager Client Tools for SLE Micro 5, Manager Client Tools 15 0.1.38-150000.1.30.1
dracut-saltboot openSUSE Leap 15.6, Manager Client Tools for SLE Micro 5, Manager Client Tools 15 1.1.0-150000.1.65.1
prometheus-blackbox_exporter openSUSE Leap 15.6, Manager Client Tools for SLE Micro 5, Manager Client Tools 15 0.26.0-150000.1.30.2
golang-github-prometheus-promu SLE Module for Package Hub 15 SP7, openSUSE Leap 15.6 0.17.0-150000.3.30.1
golang-github-boynux-squid_exporter openSUSE Leap 15.6, Manager Client Tools 15 1.13.0-150000.1.12.1

suse advisories SUSE-SU-2026:1037-1 SUSE-SU-2026:1013-1 SUSE-SU-2026:0630-1 SUSE-SU-2026:0628-1 SUSE-SU-2026:20214-1 SUSE-SU-2026:0327-1

govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
alloy openSUSE Leap 16.0 1.12.2-160000.1.1
coredns openSUSE Leap 16.0 1.14.0-bp160.1.1
alloy openSUSE Tumbleweed 1.12.2-2.1
grafana openSUSE Tumbleweed 11.6.7-2.1
coredns openSUSE Tumbleweed 1.14.0-1.1
coredns-for-k8s1.35 openSUSE Tumbleweed 1.13.1-2.1
coredns-for-k8s1.33 openSUSE Tumbleweed 1.12.0-2.1

opensuse advisories openSUSE-SU-2026:21483-1 openSUSE-SU-2026:20140-1 openSUSE-SU-2026:20099-1 openSUSE-SU-2026:10073-1 openSUSE-SU-2026:10067-1 openSUSE-SU-2026:10021-1

opentelemetry-collector AlmaLinux 9 0.135.0-2.el9_7
opentelemetry-collector AlmaLinux 10 0.135.0-2.el10_1

almalinux advisories ALSA-2025:23729 ALSA-2025:23664

opentelemetry-collector Rocky Linux 9 0.135.0-2.el9_7
opentelemetry-collector Rocky Linux 10 0.135.0-2.el10_1

rocky linux advisories RLSA-2025:23729 RLSA-2025:23664

coredns Azure Linux 3.0 1.11.4-12
keda Azure Linux 3.0 2.14.1-9

azure linux advisories AZL-72733 AZL-72736

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

github.com/expr-lang/expr#870 pull request
github.com/expr-lang/expr/security/advisories/GHSA-cfpf-hrx2-8rv6 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-68156 updated 2026-11-04 cvss 7.5

github.com/expr-lang/expr: Expr: Denial of Service via uncontrolled recursion in expression evaluation

Red Hat Deployment Validation Operator dvo/deployment-validation-rhel8-operator
affected: workaround, no fix available
Red Hat OpenShift GitOps openshift-gitops-1/argo-rollouts-rhel8
affected: workaround, no fix planned “Will not fix”
Red Hat Custom Metric Autoscaler operator for Red Hat Openshift 2.18 custom-metrics-autoscaler 1770071646, custom-metrics-autoscaler 1770071697, custom-metrics-autoscaler 1770072020, custom-metrics-autoscaler 1770072436, custom-metrics-autoscaler 1770076097
fixed: vendor fix RHSA-2026:2368
Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2 1770632254
fixed: vendor fix RHSA-2026:2572
Red Hat Ceph Storage 8.1 rhceph 1777566546
fixed: vendor fix RHSA-2026:15979
Red Hat Enterprise Linux AppStream (v. 9) opentelemetry-collector 0.135.0-2.el9_7
fixed: vendor fix RHSA-2025:23729
Red Hat Enterprise Linux AppStream (v. 10) opentelemetry-collector 0.135.0-2.el10_1
fixed: vendor fix RHSA-2025:23664
Red Hat Enterprise Linux AppStream EUS (v. 10.0) opentelemetry-collector 0.135.0-2.el10_0
fixed: vendor fix RHSA-2026:0514

show 10 more

Red Hat Enterprise Linux AppStream EUS (v.9.4) opentelemetry-collector 0.135.0-2.el9_4
fixed: vendor fix RHSA-2026:0512
Red Hat Enterprise Linux AppStream EUS (v.9.6) opentelemetry-collector 0.135.0-2.el9_6
fixed: vendor fix RHSA-2026:0513
Red Hat OpenShift AI 2.16 rhoai 1774282116, rhoai 1774282136, rhoai 1774282159, rhoai 1774282202, rhoai 1774282268, rhoai 1774282328, +1 more
fixed: vendor fix RHSA-2026:5807
Red Hat OpenShift AI 2.25 rhoai 1770055852, rhoai 1770055872, rhoai 1770055874, rhoai 1770056184, rhoai 1770223791, rhoai 1770223796, +15 more
fixed: vendor fix RHSA-2026:2695
Red Hat OpenShift AI 3.3 rhoai 1770754585, rhoai 1770754605, rhoai 1770754646, rhoai 1771363346, rhoai 1771363401, rhoai 1771363406, +5 more
fixed: vendor fix RHSA-2026:3713
Red Hat OpenShift GitOps 1.17 openshift-gitops-1 1768824532, openshift-gitops-1 1768825762
fixed: vendor fix RHSA-2026:1018
Red Hat OpenShift GitOps 1.18 openshift-gitops-1 1768881228, openshift-gitops-1 1768881232
fixed: vendor fix RHSA-2026:1017
Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2 1769720041, rhacm2 1769721579, rhacm2 1769990632, rhacm2 1769990643, rhacm2 1770039851, rhacm2 1770049220, +36 more Red Hat Ceph Storage 8.1 rhceph 1777566148, rhceph 1777566201, rhceph 1777566519, rhceph 1777566772, rhceph 1777567370, rhceph 1778049929 Red Hat OpenShift AI 2.16 rhoai 1774282058, rhoai 1774282073, rhoai 1774282078, rhoai 1774282087, rhoai 1774282092, rhoai 1774282093, +13 more Red Hat OpenShift AI 2.25 rhoai 1770053626, rhoai 1770053627, rhoai 1770053694, rhoai 1770053703, rhoai 1770053721, rhoai 1770053723, +80 more Red Hat OpenShift AI 3.3 rhoai 1769162595, rhoai 1769436305, rhoai 1769519975, rhoai 1770277795, rhoai 1770735854, rhoai 1770788873, +61 more
not affected: vulnerable code not present
Red Hat OpenShift distributed tracing 3 rhosdt/tempo-rhel8, rhosdt/tempo-query-rhel8, rhosdt/tempo-gateway-rhel8, rhosdt/tempo-rhel8-operator, rhosdt/tempo-operator-bundle, rhosdt/tempo-gateway-opa-rhel8, +5 more
not affected: vulnerable code not in execute path
Red Hat OpenShift GitOps openshift-gitops-1/dex-rhel8, openshift-gitops-1/gitops-rhel8, openshift-gitops-1/must-gather-rhel8, openshift-gitops-1/argocd-agent-rhel8, openshift-gitops-1/console-plugin-rhel8, openshift-gitops-1/gitops-rhel8-operator, +2 more Red Hat OpenShift GitOps 1.17 openshift-gitops-1 1768824197, openshift-gitops-1 1768824533, openshift-gitops-1 1768824729, openshift-gitops-1 1768824960, openshift-gitops-1 1768824983, openshift-gitops-1 1768825193, +3 more Red Hat OpenShift GitOps 1.18 openshift-gitops-1 1768880947, openshift-gitops-1 1768880997, openshift-gitops-1 1768881033, openshift-gitops-1 1768881034, openshift-gitops-1 1768881087, openshift-gitops-1 1768881701, +3 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 10 mo ago (2025-12-16)

Exploit prediction

0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
go	github.com/expr-lang/expr	<1.17.7	1.17.7

Affected products

expr-lang expr

Classification

Weakness

CWE-770 Allocation of Resources Without Limits or Throttling

References

github.com /expr-lang/expr/pull/870
web, issue-tracking, patch
github.com /expr-lang/expr/security/advisories/GHSA-cfpf-hrx2-8rv6
web, mitigation, patch, vendor-advisory, advisory
nvd.nist.gov /vuln/detail/CVE-2025-68156
advisory
github.com /expr-lang/expr
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary