CVE-2025-68156VulnerabilityPublished 16 Dec 2025

CVE-2025-68156: expr · Unthrottled Resource Allocation

Affects exprSource CVE Database V5

Not known to be exploited · CVSS 7.5 High : upgrade to 1.17.7 soon.

Data as of 26 Oct 2026, 06:26 UTC

CVSS 3.1 base score

7.5High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.4% chance of exploitation in 30 days – higher than 36% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 1.17.7

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 16 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade github.com/expr-lang/expr to 1.17.7.

Affected software

Product	Affected	Fixed in
Gogithub.com/expr-lang/expr`pkg:golang/github.com/expr-lang/expr`Other threats	Affected <1.17.7	Fixed in 1.17.7

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

The primary mitigation is to upgrade all instances of expr-lang to version 1.17.7 or later, which includes a recursion depth limit and graceful error handling to prevent stack overflow panics. Organizations should audit their codebases and dependencies to identify usage of vulnerable expr-lang versions. For environments where immediate upgrade is not feasible, implement input validation and sanitization to detect and reject cyclic or excessively deep data structures before evaluation. Developers should enforce application-level safeguards to prevent injection of maliciously crafted data into the evaluation environment. Additionally, wrapping expression evaluation calls with panic recovery mechanisms can prevent full process crashes, allowing the application to handle errors more gracefully. Monitoring and logging expression evaluation failures can help detect attempted exploitation. Security teams should also review network exposure of services using expr-lang to limit attacker access. Incorporating these mitigations reduces risk until patching can be completed.

Description

Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including `flatten`, `min`, `max`, `mean`, and `median`, perform recursive traversal over user-provided data structures without enforcing a maximum recursion depth. If the evaluation environment contains deeply nested or cyclic data structures, these functions may recurse indefinitely until exceed the Go runtime stack limit. This results in a stack overflow panic, causing the host application to crash. While exploitability depends on whether an attacker can influence or inject cyclic or pathologically deep data into the evaluation environment, this behavior represents a denial-of-service (DoS) risk and affects overall library robustness. Instead of returning a recoverable evaluation error, the process may terminate unexpectedly. In affected versions, evaluation of expressions that invoke certain builtin functions on untrusted or insufficiently validated data structures can lead to a process-level crash due to stack exhaustion. This issue is most relevant in scenarios where Expr is used to evaluate expressions against externally supplied or dynamically constructed environments; cyclic references (directly or indirectly) can be introduced into arrays, maps, or structs; and there are no application-level safeguards preventing deeply nested input data. In typical use cases with controlled, acyclic data, the issue may not manifest. However, when present, the resulting panic can be used to reliably crash the application, constituting a denial of service. The issue has been fixed in the v1.17.7 versions of Expr. The patch introduces a maximum recursion depth limit for affected builtin functions. When this limit is exceeded, evaluation aborts gracefully and returns a descriptive error instead of panicking. Additionally, the maximum depth can be customized by users via `builtin.MaxDepth`, allowing applications with legitimate deep structures to raise the limit in a controlled manner. Users are strongly encouraged to upgrade to the patched release, which includes both the recursion guard and comprehensive test coverage to prevent regressions. For users who cannot immediately upgrade, some mitigations are recommended. Ensure that evaluation environments cannot contain cyclic references, validate or sanitize externally supplied data structures before passing them to Expr, and/or wrap expression evaluation with panic recovery to prevent a full process crash (as a last-resort defensive measure). These workarounds reduce risk but do not fully eliminate the issue without the patch.

Impact

For European organizations, this vulnerability poses a significant risk of denial-of-service attacks against applications using vulnerable versions of expr-lang to evaluate expressions on untrusted or dynamically constructed data. Critical services relying on expr-lang for configuration, policy evaluation, or data processing could be disrupted by crafted inputs causing application crashes. This can lead to service downtime, loss of availability, and potential cascading effects on dependent systems. Organizations in sectors such as finance, telecommunications, government, and critical infrastructure that utilize Go-based microservices or automation tools incorporating expr-lang are particularly vulnerable. The lack of authentication or user interaction requirements means remote attackers can exploit this vulnerability over the network if the application exposes expression evaluation functionality. While the vulnerability does not affect confidentiality or integrity directly, the availability impact can degrade operational continuity and erode trust in affected services. Additionally, denial-of-service conditions could be leveraged as part of multi-stage attacks or to distract from other malicious activities.

Summary

CVE-2025-68156 is a vulnerability in the expr-lang Go library, specifically in versions before 1.17.7, where several builtin functions (flatten, min, max, mean, median) perform recursive traversal over user-provided data structures without enforcing a maximum recursion depth. This lack of limits allows an attacker to supply deeply nested or cyclic data structures that cause the recursive functions to recurse indefinitely until the Go runtime stack limit is exceeded, resulting in a stack overflow panic and crashing the host application. The vulnerability represents a denial-of-service (DoS) risk because the process terminates unexpectedly rather than returning a recoverable error. Exploitability depends on the ability of an attacker to influence or inject cyclic or pathologically deep data into the evaluation environment, which is common in scenarios where expr-lang evaluates expressions against externally supplied or dynamically constructed data. The issue is mitigated in version 1.17.7 by introducing a maximum recursion depth limit for affected functions, which aborts evaluation gracefully with a descriptive error when exceeded. This limit is customizable via the builtin.MaxDepth parameter, allowing legitimate deep structures to be handled safely. For users unable to upgrade immediately, recommended mitigations include preventing cyclic references in evaluation environments, validating or sanitizing external data before evaluation, and wrapping expression evaluation with panic recovery to avoid full process crashes. The vulnerability has a CVSS 3.1 score of 7.5 (high severity), reflecting its network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability (denial of service). No known exploits are reported in the wild yet.

CWE-770Allocation of Resources Without Limits or Throttling (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #25
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Requirements
Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
Architecture and Design
Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
OWASP ASVS 4.0.3
V8.1.4 (opens in a new tab)
V13.4.1 (opens in a new tab)
V11.1.4 (opens in a new tab)
Attack patterns
XML Ping of the Death (opens in a new tab)
Exponential Data Expansion (opens in a new tab)
Serialized Data Parameter Blowup (opens in a new tab)
Serialized Data with Nested Payloads (opens in a new tab)
Oversized Serialized Data Payloads (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 23 Dec 2025, 19:33 UTC

WeaknessesCWE-770

Technical details

References

Community reviews

Related threats