The Custom Metrics Autoscaler Operator for Red Hat OpenShift, based on KEDA 2.15.1, includes a vulnerability identified as CVE-2025-29786 in the Expr parser. This vulnerability allows attackers or inadvertent inputs to supply unbounded-length expression strings that cause the parser to build extremely large Abstract Syntax Trees (ASTs), resulting in excessive memory usage and potential out-of-memory (OOM) crashes. The underlying weakness is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-405. Red Hat's advisory recommends imposing input size restrictions before parsing to mitigate the risk. The vulnerability impacts availability by enabling denial of service through resource exhaustion. There is no explicit patch currently provided in the advisory, and users are advised to apply all previously released errata and follow operator upgrade procedures as documented by Red Hat.

This vulnerability can cause denial of service by exhausting system memory resources when processing unbounded or excessively large input expressions. This leads to potential crashes or degraded performance of the Custom Metrics Autoscaler Operator, affecting workload scaling operations in Red Hat OpenShift environments. Confidentiality and integrity impacts are not reported. The severity is considered high due to the availability impact.

Red Hat recommends imposing input size restrictions before parsing expressions to prevent unbounded-length inputs that cause excessive memory consumption. This mitigation avoids the construction of very large Abstract Syntax Trees and prevents potential out-of-memory crashes. Users should ensure all previously released errata relevant to their system are applied and follow Red Hat's documented procedures for upgrading operators. No official patch or update specifically addressing this vulnerability is currently stated in the advisory; patch status is not yet confirmed—check Red Hat advisories for updates.