Skip to content
OpenAdvisories

Package · Go

github.com/expr-lang/expr

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.5
    CVE-2025-68156

    Expr has Denial of Service via Unbounded Recursion in Builtin Functions

    Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including `flatten`, `min`, `max`, `mean`, and `median`, perform recursive traversal over user-provided data structures without enforc…

    expr-lang expr github.com/expr-lang/expr Go
  • High 7.5
    CVE-2025-29786

    Memory Exhaustion in Expr Parser with Unrestricted Input

    Expr is an expression language and expression evaluation for Go. Prior to version 1.17.0, if the Expr expression parser is given an unbounded input string, it will attempt to compile the entire string and generate an Abstract Syntax Tree (AST) node for each p…

    expr-lang expr github.com/expr-lang/expr golang-github-antonmedv-expr Debian Ubuntu Go