CVE-2025-68156 is a vulnerability in the expr-lang library, a Go-based expression language and evaluation tool. Prior to version 1.17.7, several builtin functions (flatten, min, max, mean, median) perform recursive traversals over user-supplied data structures without enforcing a maximum recursion depth. This lack of throttling allows an attacker to supply deeply nested or cyclic data structures that cause the recursion to continue indefinitely until the Go runtime stack limit is exceeded, resulting in a stack overflow panic. This panic causes the host application to crash abruptly, leading to a denial-of-service (DoS) condition. The vulnerability is particularly relevant when expr-lang is used to evaluate expressions against externally supplied or dynamically constructed environments where cyclic references can be introduced in arrays, maps, or structs. Typical use cases with controlled, acyclic data do not manifest this issue. The patch in version 1.17.7 introduces a configurable maximum recursion depth for the affected builtin functions, enabling graceful aborts with descriptive errors instead of panics. For users unable to upgrade immediately, recommended mitigations include ensuring no cyclic references exist in evaluation environments, validating or sanitizing input data, and wrapping expression evaluation with panic recovery to prevent full process crashes. The CVSS v3.1 score is 7.5 (high), reflecting the vulnerability's network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability (denial of service). No known exploits are currently reported in the wild.

For European organizations, the primary impact of CVE-2025-68156 is denial of service due to application crashes when processing maliciously crafted or malformed input data in expr-lang-based systems. This can disrupt backend services, APIs, or microservices that rely on expr for expression evaluation, potentially affecting business continuity and service availability. Industries with high reliance on Go-based infrastructure, such as fintech, telecommunications, cloud service providers, and software development firms, may experience operational interruptions. The vulnerability does not directly compromise confidentiality or integrity but can be leveraged by attackers to cause persistent service outages. In multi-tenant or cloud environments, this could lead to cascading failures or impact multiple customers. The ease of exploitation without authentication increases risk, especially in public-facing services that accept user input evaluated by expr. Organizations that do not sanitize or validate input data or lack panic recovery mechanisms are particularly vulnerable. The availability impact may also affect compliance with European regulations requiring service continuity and incident management, such as GDPR and NIS Directive.

The most effective mitigation is to upgrade expr-lang to version 1.17.7 or later, which includes a maximum recursion depth limit and graceful error handling to prevent stack overflow panics. For organizations unable to upgrade immediately, implement strict validation and sanitization of all externally supplied or dynamically constructed data structures passed to expr to ensure they do not contain cyclic references or excessive nesting. Introduce application-level safeguards that detect and reject or flatten deeply nested data before evaluation. Wrap expression evaluation calls with panic recovery mechanisms in Go to prevent process crashes from propagating and causing service outages. Additionally, configure the maximum recursion depth parameter (builtin.MaxDepth) in the patched version to balance between legitimate deep data structures and security. Conduct thorough testing of expression evaluation components under various input scenarios to identify potential recursion risks. Monitor application logs for stack overflow panics or crashes indicative of exploitation attempts. Finally, review and update incident response plans to include detection and mitigation of expr-lang related DoS attacks.