{"id":"GHSA-cfpf-hrx2-8rv6","revision":null,"records":[{"revision":"923b3ea0213b47c89b828ffe97a839c2","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-68156","aliases":[],"title":"Expr has Denial of Service via Unbounded Recursion in Builtin Functions","description":"Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including `flatten`, `min`, `max`, `mean`, and `median`, perform recursive traversal over user-provided data structures without enforcing a maximum recursion depth. If the evaluation environment contains deeply nested or cyclic data structures, these functions may recurse indefinitely until exceed the Go runtime stack limit. This results in a stack overflow panic, causing the host application to crash. While exploitability depends on whether an attacker can influence or inject cyclic or pathologically deep data into the\nevaluation environment, this behavior represents a denial-of-service (DoS) risk and affects overall library robustness. Instead of returning a recoverable evaluation error, the process may terminate unexpectedly. In affected versions, evaluation of expressions that invoke certain builtin functions on untrusted or insufficiently validated data structures can lead to a process-level crash due to stack exhaustion. This issue is most relevant in scenarios where Expr is used to evaluate expressions against externally supplied or dynamically constructed environments; cyclic references (directly or indirectly) can be introduced into arrays, maps, or structs; and there are no application-level safeguards preventing deeply nested input data. In typical use cases with controlled, acyclic data, the issue may not manifest. However, when present, the resulting panic can be used to reliably crash the application, constituting a denial of service. The issue has been fixed in the v1.17.7 versions of Expr. The patch introduces a maximum recursion depth limit for affected builtin functions. When this limit is exceeded, evaluation aborts gracefully and returns a descriptive error instead of panicking. Additionally, the maximum depth can be customized by users via `builtin.MaxDepth`, allowing applications with legitimate deep structures to raise the limit in a controlled manner. Users are strongly encouraged to upgrade to the patched release, which includes both the recursion guard and comprehensive test coverage to prevent regressions. For users who cannot immediately upgrade, some mitigations are recommended. Ensure that evaluation environments cannot contain cyclic references, validate or sanitize externally supplied data structures before passing them to Expr, and/or wrap expression evaluation with panic recovery to prevent a full process crash (as a last-resort defensive measure). These workarounds reduce risk but do not fully eliminate the issue without the patch.","state":0,"publishedAt":"2025-12-16T18:24:11.648+00:00","modifiedAt":"2025-12-16T19:59:24.007+00:00","affected":[{"ecosystem":"Vendor product","name":"expr","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"expr-lang\",\n                    \"product\": \"expr\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.17.7\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/expr-lang/expr/security/advisories/GHSA-cfpf-hrx2-8rv6","https://github.com/expr-lang/expr/pull/870"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-68156","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-68156","identifiers":["CVE-2025-68156"]},"retained":false,"historicalAffected":[]},{"revision":"6a4f425f44bd494bb2d766d61b24819d","observedAt":"2026-11-09T04:10:54.224+00:00","statement":{"source":"euvd","id":"EUVD-2025-203831","aliases":["CVE-2025-68156","GHSA-cfpf-hrx2-8rv6"],"title":"Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including `flatten`, `min`, `max`, `mean`, and `median`, perform recursive traversal over user-provided data struct…","description":"Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including `flatten`, `min`, `max`, `mean`, and `median`, perform recursive traversal over user-provided data structures without enforcing a maximum recursion depth. If the evaluation environment contains deeply nested or cyclic data structures, these functions may recurse indefinitely until exceed the Go runtime stack limit. This results in a stack overflow panic, causing the host application to crash. While exploitability depends on whether an attacker can influence or inject cyclic or pathologically deep data into the\nevaluation environment, this behavior represents a denial-of-service (DoS) risk and affects overall library robustness. Instead of returning a recoverable evaluation error, the process may terminate unexpectedly. In affected versions, evaluation of expressions that invoke certain builtin functions on untrusted or insufficiently validated data structures can lead to a process-level crash due to stack exhaustion. This issue is most relevant in scenarios where Expr is used to evaluate expressions against externally supplied or dynamically constructed environments; cyclic references (directly or indirectly) can be introduced into arrays, maps, or structs; and there are no application-level safeguards preventing deeply nested input data. In typical use cases with controlled, acyclic data, the issue may not manifest. However, when present, the resulting panic can be used to reliably crash the application, constituting a denial of service. The issue has been fixed in the v1.17.7 versions of Expr. The patch introduces a maximum recursion depth limit for affected builtin functions. When this limit is exceeded, evaluation aborts gracefully and returns a descriptive error instead of panicking. Additionally, the maximum depth can be customized by users via `builtin.MaxDepth`, allowing applications with legitimate deep structures to raise the limit in a controlled manner. Users are strongly encouraged to upgrade to the patched release, which includes both the recursion guard and comprehensive test coverage to prevent regressions. For users who cannot immediately upgrade, some mitigations are recommended. Ensure that evaluation environments cannot contain cyclic references, validate or sanitize externally supplied data structures before passing them to Expr, and/or wrap expression evaluation with panic recovery to prevent a full process crash (as a last-resort defensive measure). These workarounds reduce risk but do not fully eliminate the issue without the patch.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/expr-lang/expr/security/advisories/GHSA-cfpf-hrx2-8rv6","https://github.com/expr-lang/expr/pull/870"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-203831","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Dec 16, 2025, 6:24:11 PM","dateUpdated":"Dec 16, 2025, 7:59:24 PM"},"relatedAdvisories":[{"id":"RHSA-2025:23729","title":"Red Hat Security Advisory: opentelemetry-collector security update","vulnerabilityIds":["CVE-2025-68156"]},{"id":"openSUSE-SU-2026:20140-1","title":"Security update for alloy","vulnerabilityIds":["CVE-2025-31133","CVE-2025-52565","CVE-2025-52881","CVE-2025-68156"]},{"id":"SUSE-SU-2026:0630-1","title":"Security update 5.1.2 for Multi-Linux Manager Client Tools","vulnerabilityIds":["CVE-2025-12816","CVE-2025-68156"]},{"id":"RHSA-2026:2695","title":"Red Hat Security Advisory: RHOAI 2.25.2 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2025-12805","CVE-2025-12816","CVE-2025-14925","CVE-2025-52881","CVE-2025-66034","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2025-66626","CVE-2025-68156","CVE-2025-68476","CVE-2025-69223","CVE-2026-21441","CVE-2026-24049"]},{"id":"RHSA-2026:2572","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.14.2 security update","vulnerabilityIds":["CVE-2025-7195","CVE-2025-47907","CVE-2025-53547","CVE-2025-58183","CVE-2025-61729","CVE-2025-68156","CVE-2026-22029"]},{"id":"openSUSE-SU-2025:15832-1","title":"coredns-for-k8s1.35-1.13.1-2.1 on GA media","vulnerabilityIds":["CVE-2025-68156"]},{"id":"RHSA-2026:1017","title":"Red Hat Security Advisory: Red Hat OpenShift GitOps v1.18.3 security update","vulnerabilityIds":["CVE-2025-13888","CVE-2025-47913","CVE-2025-55190","CVE-2025-58183","CVE-2025-61729","CVE-2025-68156"]},{"id":"openSUSE-SU-2026:10021-1","title":"coredns-1.14.0-1.1 on GA media","vulnerabilityIds":["CVE-2025-68156"]},{"id":"RHSA-2026:0514","title":"Red Hat Security Advisory: opentelemetry-collector security update","vulnerabilityIds":["CVE-2025-68156"]},{"id":"openSUSE-SU-2026:20099-1","title":"Security update for coredns","vulnerabilityIds":["CVE-2024-51744","CVE-2025-58063","CVE-2025-68156","CVE-2025-68161"]},{"id":"RHSA-2026:5807","title":"Red Hat Security Advisory: RHOAI 2.16.4 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2024-25621","CVE-2025-6193","CVE-2025-12060","CVE-2025-12638","CVE-2025-12816","CVE-2025-61726","CVE-2025-61729","CVE-2025-66031","CVE-2025-66418","CVE-2025-66626","CVE-2025-68156","CVE-2025-69873","CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-25223","CVE-2026-25639","CVE-2026-29074","CVE-2026-32141"]},{"id":"SUSE-SU-2026:1013-1","title":"Security update 5.0.7 for Multi-Linux Manager Client Tools","vulnerabilityIds":["CVE-2025-12816","CVE-2025-13465","CVE-2025-3415","CVE-2025-61140","CVE-2025-68156","CVE-2026-1615","CVE-2026-21720","CVE-2026-21721","CVE-2026-21722","CVE-2026-25547","CVE-2026-27606"]},{"id":"RHSA-2026:2368","title":"Red Hat Security Advisory: Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.18.1-2 Update","vulnerabilityIds":["CVE-2025-68156","CVE-2025-68476"]},{"id":"RHSA-2026:3713","title":"Red Hat Security Advisory: RHOAI 3.3 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2024-25621","CVE-2025-6242","CVE-2025-12638","CVE-2025-12816","CVE-2025-14180","CVE-2025-14920","CVE-2025-14921","CVE-2025-14922","CVE-2025-14924","CVE-2025-14925","CVE-2025-14926","CVE-2025-14927","CVE-2025-14928","CVE-2025-14929","CVE-2025-14930","CVE-2025-15284","CVE-2025-48956","CVE-2025-52881","CVE-2025-59425","CVE-2025-61726","CVE-2025-61729","CVE-2025-62164","CVE-2025-62593","CVE-2025-64756","CVE-2025-66031","CVE-2025-66034","CVE-2025-66416","CVE-2025-66418","CVE-2025-66448","CVE-2025-66471","CVE-2025-66506","CVE-2025-66626","CVE-2025-67725","CVE-2025-67726","CVE-2025-68156","CVE-2025-68476","CVE-2025-68665","CVE-2025-69223","CVE-2025-69872","CVE-2026-0897","CVE-2026-1260","CVE-2026-21441","CVE-2026-22778","CVE-2026-22807","CVE-2026-24049","CVE-2026-24486"]},{"id":"SUSE-SU-2026:0327-1","title":"Security update for alloy","vulnerabilityIds":["CVE-2025-31133","CVE-2025-52565","CVE-2025-52881","CVE-2025-68156"]},{"id":"openSUSE-SU-2026:10067-1","title":"grafana-11.6.7-2.1 on GA media","vulnerabilityIds":["CVE-2025-68156"]},{"id":"RHSA-2026:1018","title":"Red Hat Security Advisory: Red Hat OpenShift GitOps v1.17.4 security update","vulnerabilityIds":["CVE-2025-47913","CVE-2025-55190","CVE-2025-58183","CVE-2025-58754","CVE-2025-61729","CVE-2025-68156"]},{"id":"RHSA-2026:0512","title":"Red Hat Security Advisory: opentelemetry-collector security update","vulnerabilityIds":["CVE-2025-68156"]},{"id":"RHSA-2026:0513","title":"Red Hat Security Advisory: opentelemetry-collector security update","vulnerabilityIds":["CVE-2025-68156"]},{"id":"RHSA-2026:2106","title":"Red Hat Security Advisory: RHOAI 2.25.2 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2025-12805","CVE-2025-12816","CVE-2025-52881","CVE-2025-66034","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2025-66626","CVE-2025-67725","CVE-2025-67726","CVE-2025-68156","CVE-2025-68476","CVE-2025-69223","CVE-2026-21441","CVE-2026-24049"]},{"id":"WID-SEC-W-2025-2886","title":"Red Hat Enterprise Linux (git-lfs, opentelemetry-collector): Mehrere Schwachstellen","vulnerabilityIds":["CVE-2025-26625","CVE-2025-68156"]},{"id":"SUSE-SU-2026:1037-1","title":"Security update for grafana","vulnerabilityIds":["CVE-2025-3415","CVE-2025-68156","CVE-2026-21720","CVE-2026-21721","CVE-2026-21722"]},{"id":"openSUSE-SU-2026:20654-1","title":"Security update for grafana","vulnerabilityIds":["CVE-2023-45288","CVE-2024-11741","CVE-2024-28180","CVE-2024-45339","CVE-2024-51744","CVE-2024-9264","CVE-2024-9476","CVE-2025-11065","CVE-2025-21613","CVE-2025-22870","CVE-2025-22872","CVE-2025-2703","CVE-2025-27144","CVE-2025-29923","CVE-2025-3415","CVE-2025-3454","CVE-2025-3580","CVE-2025-4123","CVE-2025-47911","CVE-2025-58190","CVE-2025-6023","CVE-2025-6197","CVE-2025-64751","CVE-2025-68156","CVE-2026-21720","CVE-2026-21721","CVE-2026-21722"]},{"id":"RHSA-2025:23664","title":"Red Hat Security Advisory: opentelemetry-collector security update","vulnerabilityIds":["CVE-2025-68156"]},{"id":"SUSE-SU-2026:0628-1","title":"Security update 5.1.2 for Multi-Linux Manager Client Tools","vulnerabilityIds":["CVE-2025-12816","CVE-2025-68156"]},{"id":"RHSA-2026:15979","title":"Red Hat Security Advisory: Red Hat Ceph Storage","vulnerabilityIds":["CVE-2025-13033","CVE-2025-47914","CVE-2025-58181","CVE-2025-61729","CVE-2025-64718","CVE-2025-64756","CVE-2025-68156"]},{"id":"openSUSE-SU-2026:10073-1","title":"alloy-1.12.2-2.1 on GA media","vulnerabilityIds":["CVE-2025-31133","CVE-2025-68156"]},{"id":"openSUSE-SU-2025:15826-1","title":"coredns-for-k8s1.34-1.12.1-2.1 on GA media","vulnerabilityIds":["CVE-2025-68156"]},{"id":"openSUSE-SU-2025:15825-1","title":"coredns-for-k8s1.33-1.12.0-2.1 on GA media","vulnerabilityIds":["CVE-2025-68156"]},{"id":"SUSE-SU-2026:20214-1","title":"Security update for alloy","vulnerabilityIds":["CVE-2025-31133","CVE-2025-52565","CVE-2025-52881","CVE-2025-68156"]},{"id":"msrc_CVE-2025-68156","title":"Expr has Denial of Service via Unbounded Recursion in Builtin Functions","vulnerabilityIds":["CVE-2025-68156"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-203831","identifiers":["EUVD-2025-203831","CVE-2025-68156","GHSA-cfpf-hrx2-8rv6"]},"retained":false,"historicalAffected":[]},{"revision":"fb847eb948c740298b69d07b87d28b85","observedAt":"2026-10-25T04:17:10.72+00:00","statement":{"source":"nvd","id":"CVE-2025-68156","aliases":[],"title":"Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including `flatten`, `min`, `max`, `mean`, and `median`, perform recursive traversal over user-provided data struct…","description":"Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including `flatten`, `min`, `max`, `mean`, and `median`, perform recursive traversal over user-provided data structures without enforcing a maximum recursion depth. If the evaluation environment contains deeply nested or cyclic data structures, these functions may recurse indefinitely until exceed the Go runtime stack limit. This results in a stack overflow panic, causing the host application to crash. While exploitability depends on whether an attacker can influence or inject cyclic or pathologically deep data into the\nevaluation environment, this behavior represents a denial-of-service (DoS) risk and affects overall library robustness. Instead of returning a recoverable evaluation error, the process may terminate unexpectedly. In affected versions, evaluation of expressions that invoke certain builtin functions on untrusted or insufficiently validated data structures can lead to a process-level crash due to stack exhaustion. This issue is most relevant in scenarios where Expr is used to evaluate expressions against externally supplied or dynamically constructed environments; cyclic references (directly or indirectly) can be introduced into arrays, maps, or structs; and there are no application-level safeguards preventing deeply nested input data. In typical use cases with controlled, acyclic data, the issue may not manifest. However, when present, the resulting panic can be used to reliably crash the application, constituting a denial of service. The issue has been fixed in the v1.17.7 versions of Expr. The patch introduces a maximum recursion depth limit for affected builtin functions. When this limit is exceeded, evaluation aborts gracefully and returns a descriptive error instead of panicking. Additionally, the maximum depth can be customized by users via `builtin.MaxDepth`, allowing applications with legitimate deep structures to raise the limit in a controlled manner. Users are strongly encouraged to upgrade to the patched release, which includes both the recursion guard and comprehensive test coverage to prevent regressions. For users who cannot immediately upgrade, some mitigations are recommended. Ensure that evaluation environments cannot contain cyclic references, validate or sanitize externally supplied data structures before passing them to Expr, and/or wrap expression evaluation with panic recovery to prevent a full process crash (as a last-resort defensive measure). These workarounds reduce risk but do not fully eliminate the issue without the patch.","state":0,"publishedAt":"2025-12-16T19:16:00.567+00:00","modifiedAt":"2026-10-13T11:10:00.203+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/expr-lang/expr/pull/870","https://github.com/expr-lang/expr/security/advisories/GHSA-cfpf-hrx2-8rv6"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-68156","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-770"],"productCriteria":["cpe:2.3:a:expr-lang:expr:*:*:*:*:*:go:*:*"],"sourceDates":{"published":"2025-12-16T19:16:00.567","lastModified":"2026-10-13T11:10:00.203"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-68156","identifiers":["CVE-2025-68156"]},"retained":false,"historicalAffected":[]},{"revision":"6e4411b7b3fb441683f7ef7613d58297","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-cfpf-hrx2-8rv6","aliases":["CVE-2025-68156","GO-2025-4245"],"title":"Expr has Denial of Service via Unbounded Recursion in Builtin Functions","description":"Several builtin functions in Expr, including `flatten`, `min`, `max`, `mean`, and `median`, perform\nrecursive traversal over user-provided data structures without enforcing a maximum recursion depth.\n\nIf the evaluation environment contains **deeply nested** or **cyclic** data structures, these functions may recurse\nindefinitely until exceed the Go runtime stack limit. This results in a **stack overflow panic**, causing the host\napplication to crash.\n\nWhile exploitability depends on whether an attacker can influence or inject cyclic or pathologically deep data into the\nevaluation environment, this behavior represents a denial-of-service (DoS) risk and affects overall library robustness.\nInstead of returning a recoverable evaluation error, the process may terminate unexpectedly.\n\n### Impact\n\nIn affected versions, evaluation of expressions that invoke certain builtin functions on untrusted or insufficiently\nvalidated data structures can lead to a **process-level crash** due to stack exhaustion.\n\nThis issue is most relevant in scenarios where:\n\n* Expr is used to evaluate expressions against externally supplied or dynamically constructed environments.\n* Cyclic references (directly or indirectly) can be introduced into arrays, maps, or structs.\n* There are no application-level safeguards preventing deeply nested input data.\n\nIn typical use cases with controlled, acyclic data, the issue may not manifest. However, when present, the resulting\npanic can be used to reliably crash the application, constituting a denial of service.\n\n### Patches\n\nThe issue has been fixed in the v1.17.7 versions of Expr.\n\nThe patch introduces a **maximum recursion depth limit** for affected builtin functions. When this limit is exceeded,\nevaluation aborts gracefully and returns a descriptive error instead of panicking.\n\nAdditionally, the maximum depth can be customized by users via `builtin.MaxDepth`, allowing applications with legitimate\ndeep structures to raise the limit in a controlled manner.\n\nUsers are strongly encouraged to upgrade to the patched release, which includes both the recursion guard and\ncomprehensive test coverage to prevent regressions.\n\n### Workarounds\n\nFor users who cannot immediately upgrade, the following mitigations are recommended:\n\n* Ensure that evaluation environments cannot contain cyclic references.\n* Validate or sanitize externally supplied data structures before passing them to Expr.\n* Wrap expression evaluation with panic recovery to prevent a full process crash (as a last-resort defensive measure).\n\nThese workarounds reduce risk but do not fully eliminate the issue without the patch.","state":0,"publishedAt":"2025-12-16T22:34:16+00:00","modifiedAt":"2026-09-10T03:50:58.5147656+00:00","affected":[{"ecosystem":"Go","name":"github.com/expr-lang/expr","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.17.7"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/expr-lang/expr/security/advisories/GHSA-cfpf-hrx2-8rv6","https://nvd.nist.gov/vuln/detail/CVE-2025-68156","https://github.com/expr-lang/expr/pull/870","https://github.com/expr-lang/expr"],"sourceUrl":"https://github.com/advisories/GHSA-cfpf-hrx2-8rv6","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-cfpf-hrx2-8rv6","identifiers":["GHSA-cfpf-hrx2-8rv6","CVE-2025-68156","GO-2025-4245"]},"retained":false,"historicalAffected":[]},{"revision":"bb42c33caa3841ea805c774c08e279ec","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2025-4245","aliases":["CVE-2025-68156","GHSA-cfpf-hrx2-8rv6"],"title":"Expr has Denial of Service via Unbounded Recursion in Builtin Functions in github.com/expr-lang/expr","description":"Expr has Denial of Service via Unbounded Recursion in Builtin Functions in github.com/expr-lang/expr","state":0,"publishedAt":"2025-12-22T18:15:35+00:00","modifiedAt":"2026-02-04T04:25:04.549775+00:00","affected":[{"ecosystem":"Go","name":"github.com/expr-lang/expr","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.17.7"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/expr-lang/expr/security/advisories/GHSA-cfpf-hrx2-8rv6","https://github.com/expr-lang/expr/pull/870"],"sourceUrl":"https://osv.dev/vulnerability/GO-2025-4245","license":"OSV · upstream source license applies","key":"osv:GO-2025-4245","identifiers":["GO-2025-4245","CVE-2025-68156","GHSA-cfpf-hrx2-8rv6"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T09:21:39.5670180+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T09:21:39.567018+00:00","lastSuccessAt":"2026-11-10T09:21:39.7230126+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:39.7230148+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-8bdcdeeb414e06ff50ed637d818ac25d52680d19f71fc0ebe3f4c4b3f836ed38","complete":true,"records":421927,"lastAttemptAt":"2026-11-10T09:21:38.2251552+00:00","lastSuccessAt":"2026-11-10T09:21:38.1064889+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:38.2251552+00:00","snapshotPublishedAt":"2026-11-10T09:20:43+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2e6a476534094233b48f2f0b6da5cf35","complete":true,"records":13689,"lastAttemptAt":"2026-11-10T09:22:06.7603645+00:00","lastSuccessAt":"2026-11-10T06:05:35.03+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:05:35.03+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13742,"expectedIdentifiers":13742,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T09:21:39.5670180+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T09:21:39.567018+00:00","lastSuccessAt":"2026-11-10T09:21:39.7239823+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:39.7239826+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-31ba7927d759462ab5120f3eef3ca629","complete":false,"records":13695,"lastAttemptAt":"2026-11-10T09:22:06.1277445+00:00","lastSuccessAt":"2026-11-10T09:22:06.124+00:00","error":"100 identifier lookups failed; latest failures include request timeout. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T09:22:06.124+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13642,"expectedIdentifiers":13742,"failedIdentifiers":100},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T09:21:39.3678777+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:39.3678777+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T09:21:39.1274719+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:39.1274719+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-94169eec81ea3989aa551092397ff34ae53c104b4a6ce646e1524452e4ab2a39","complete":true,"records":3065,"lastAttemptAt":"2026-11-10T09:21:39.5260038+00:00","lastSuccessAt":"2026-11-10T08:04:45.5923716+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:39.5260038+00:00","snapshotPublishedAt":"2026-11-10T06:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-4331051b0b2d4ccdbdca3aa196b0be3818a465064a4b18dde4cf39c2250eb490","complete":true,"records":231599,"lastAttemptAt":"2026-11-10T09:21:39.251251+00:00","lastSuccessAt":"2026-11-10T08:04:37.1757322+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:39.251251+00:00","snapshotPublishedAt":"2026-11-10T07:33:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}