CVE-2025-68156
Expr has Denial of Service via Unbounded Recursion in Builtin Functions
Description
Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including `flatten`, `min`, `max`, `mean`, and `median`, perform recursive traversal over user-provided data structures without enforcing a maximum recursion depth. If the evaluation environment contains deeply nested or cyclic data structures, these functions may recurse indefinitely until exceed the Go runtime stack limit. This results in a stack overflow panic, causing the host application to crash. While exploitability depends on whether an attacker can influence or inject cyclic or pathologically deep data into the evaluation environment, this behavior represents a denial-of-service (DoS) risk and affects overall library robustness. Instead of returning a recoverable evaluation error, the process may terminate unexpectedly. In affected versions, evaluation of expressions that invoke certain builtin functions on untrusted or insufficiently validated data structures can lead to a process-level crash due to stack exhaustion. This issue is most relevant in scenarios where Expr is used to evaluate expressions against externally supplied or dynamically constructed environments; cyclic references (directly or indirectly) can be introduced into arrays, maps, or structs; and there are no application-level safeguards preventing deeply nested input data. In typical use cases with controlled, acyclic data, the issue may not manifest. However, when present, the resulting panic can be used to reliably crash the application, constituting a denial of service. The issue has been fixed in the v1.17.7 versions of Expr. The patch introduces a maximum recursion depth limit for affected builtin functions. When this limit is exceeded, evaluation aborts gracefully and returns a descriptive error instead of panicking. Additionally, the maximum depth can be customized by users via `builtin.MaxDepth`, allowing applications with legitimate deep structures to raise the limit in a controlled manner. Users are strongly encouraged to upgrade to the patched release, which includes both the recursion guard and comprehensive test coverage to prevent regressions. For users who cannot immediately upgrade, some mitigations are recommended. Ensure that evaluation environments cannot contain cyclic references, validate or sanitize externally supplied data structures before passing them to Expr, and/or wrap expression evaluation with panic recovery to prevent a full process crash (as a last-resort defensive measure). These workarounds reduce risk but do not fully eliminate the issue without the patch.
INFO
Published Date :
Dec. 16, 2025, 7:16 p.m.
Last Modified :
Oct. 13, 2026, 11:10 a.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Upgrade Expr to version 1.17.7 or later.
- Implement application-level recursion depth limits.
- Sanitize or validate external data before evaluation.
- Wrap evaluation with panic recovery.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-68156.
| URL | Resource |
|---|---|
| https://github.com/expr-lang/expr/pull/870 | Issue Tracking Patch |
| https://github.com/expr-lang/expr/security/advisories/GHSA-cfpf-hrx2-8rv6 | Mitigation Patch Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-68156 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-68156
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-68156 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-68156 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 13, 2026
Action Type Old Value New Value Added Translation Title: expr-lang, Description: Expr es un lenguaje de expresiones y evaluación de expresiones para Go. Antes de la versión 1.17.7, varias funciones integradas en Expr, incluyendo 'flatten', 'min', 'max', 'mean' y 'median', realizan un recorrido recursivo sobre estructuras de datos proporcionadas por el usuario sin imponer una profundidad máxima de recursión. Si el entorno de evaluación contiene estructuras de datos profundamente anidadas o cíclicas, estas funciones pueden recursar indefinidamente hasta exceder el límite de pila del tiempo de ejecución de Go. Esto resulta en un pánico por desbordamiento de pila, causando que la aplicación anfitriona falle. Aunque la explotabilidad depende de si un atacante puede influir o inyectar datos cíclicos o patológicamente profundos en el entorno de evaluación, este comportamiento representa un riesgo de denegación de servicio (DoS) y afecta la robustez general de la biblioteca. En lugar de devolver un error de evaluación recuperable, el proceso puede terminar inesperadamente. En las versiones afectadas, la evaluación de expresiones que invocan ciertas funciones integradas en estructuras de datos no confiables o insuficientemente validadas puede llevar a un fallo a nivel de proceso debido al agotamiento de la pila. Este problema es más relevante en escenarios donde Expr se utiliza para evaluar expresiones contra entornos suministrados externamente o construidos dinámicamente; se pueden introducir referencias cíclicas (directa o indirectamente) en arrays, mapas o structs; y no existen salvaguardas a nivel de aplicación que impidan datos de entrada profundamente anidados. En casos de uso típicos con datos controlados y acíclicos, el problema puede no manifestarse. Sin embargo, cuando está presente, el pánico resultante puede usarse para bloquear la aplicación de manera confiable, constituyendo una denegación de servicio. El problema ha sido solucionado en las versiones v1.17.7 de Expr. El parche introduce un límite de profundidad máxima de recursión para las funciones integradas afectadas. Cuando se excede este límite, la evaluación se aborta de forma controlada y devuelve un error descriptivo en lugar de entrar en pánico. Además, la profundidad máxima puede ser personalizada por los usuarios a través de 'builtin.MaxDepth', permitiendo que las aplicaciones con estructuras profundas legítimas aumenten el límite de manera controlada. Se recomienda encarecidamente a los usuarios que actualicen a la versión parcheada, que incluye tanto la protección de recursión como una cobertura de pruebas exhaustiva para prevenir regresiones. Para los usuarios que no pueden actualizar inmediatamente, se recomiendan algunas mitigaciones. Asegúrese de que los entornos de evaluación no puedan contener referencias cíclicas, valide o sanee las estructuras de datos suministradas externamente antes de pasarlas a Expr, y/o envuelva la evaluación de expresiones con recuperación de pánico para evitar un fallo completo del proceso (como medida defensiva de último recurso). Estas soluciones temporales reducen el riesgo pero no eliminan completamente el problema sin el parche. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'expr-lang', 'product': 'expr', 'versions': [{'status': 'affected', 'version': '< 1.17.7'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-68156', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2025-12-16T19:58:48.969218Z'} -
Initial Analysis by [email protected]
Mar. 05, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:expr-lang:expr:*:*:*:*:*:go:*:* versions up to (excluding) 1.17.7 Added Reference Type GitHub, Inc.: https://github.com/expr-lang/expr/pull/870 Types: Issue Tracking, Patch Added Reference Type GitHub, Inc.: https://github.com/expr-lang/expr/security/advisories/GHSA-cfpf-hrx2-8rv6 Types: Mitigation, Patch, Vendor Advisory -
New CVE Received by [email protected]
Dec. 16, 2025
Action Type Old Value New Value Added Description Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including `flatten`, `min`, `max`, `mean`, and `median`, perform recursive traversal over user-provided data structures without enforcing a maximum recursion depth. If the evaluation environment contains deeply nested or cyclic data structures, these functions may recurse indefinitely until exceed the Go runtime stack limit. This results in a stack overflow panic, causing the host application to crash. While exploitability depends on whether an attacker can influence or inject cyclic or pathologically deep data into the evaluation environment, this behavior represents a denial-of-service (DoS) risk and affects overall library robustness. Instead of returning a recoverable evaluation error, the process may terminate unexpectedly. In affected versions, evaluation of expressions that invoke certain builtin functions on untrusted or insufficiently validated data structures can lead to a process-level crash due to stack exhaustion. This issue is most relevant in scenarios where Expr is used to evaluate expressions against externally supplied or dynamically constructed environments; cyclic references (directly or indirectly) can be introduced into arrays, maps, or structs; and there are no application-level safeguards preventing deeply nested input data. In typical use cases with controlled, acyclic data, the issue may not manifest. However, when present, the resulting panic can be used to reliably crash the application, constituting a denial of service. The issue has been fixed in the v1.17.7 versions of Expr. The patch introduces a maximum recursion depth limit for affected builtin functions. When this limit is exceeded, evaluation aborts gracefully and returns a descriptive error instead of panicking. Additionally, the maximum depth can be customized by users via `builtin.MaxDepth`, allowing applications with legitimate deep structures to raise the limit in a controlled manner. Users are strongly encouraged to upgrade to the patched release, which includes both the recursion guard and comprehensive test coverage to prevent regressions. For users who cannot immediately upgrade, some mitigations are recommended. Ensure that evaluation environments cannot contain cyclic references, validate or sanitize externally supplied data structures before passing them to Expr, and/or wrap expression evaluation with panic recovery to prevent a full process crash (as a last-resort defensive measure). These workarounds reduce risk but do not fully eliminate the issue without the patch. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-770 Added Reference https://github.com/expr-lang/expr/pull/870 Added Reference https://github.com/expr-lang/expr/security/advisories/GHSA-cfpf-hrx2-8rv6