CVE-2025-68156 is a denial of service vulnerability in the Expr Go library used by the Custom Metrics Autoscaler Operator for Red Hat OpenShift. The vulnerability arises from uncontrolled recursion during expression evaluation of user-provided data structures that are deeply nested or cyclic, leading to stack overflow and application crash. This affects Red Hat products that utilize the Expr library and evaluate expressions against untrusted or insufficiently validated data. The vulnerability is rated important due to its potential to cause denial of service. Mitigations include validating or sanitizing input data structures to avoid cyclic references and wrapping expression evaluation with panic recovery. Red Hat has released updated operator images based on KEDA 2.18.1 to address this issue.

Successful exploitation can cause a denial of service by crashing the application through stack overflow. This impacts availability but does not affect confidentiality or integrity. Only applications that evaluate expressions against untrusted or insufficiently validated data structures using the Expr library are affected.

Red Hat has released updated Custom Metrics Autoscaler Operator images based on KEDA 2.18.1 that address this vulnerability. Users should apply these updates after ensuring all prior relevant errata are applied. Additionally, applications should validate or sanitize externally supplied data structures to prevent cyclic references before passing them to Expr for evaluation. Wrapping expression evaluation with panic recovery can also help prevent full process crashes. Follow Red Hat's official update instructions at https://access.redhat.com/articles/11258.