CVE-2025-68156
📋 TL;DR
This vulnerability in Expr for Go allows denial-of-service attacks through stack overflow panics. Attackers can crash applications by providing deeply nested or cyclic data structures to certain builtin functions. It affects applications using Expr versions before 1.17.7 to evaluate expressions against untrusted data.
💻 Affected Systems
- Expr (Go expression language library)
📦 What is this software?
Expr by Expr Lang
⚠️ Risk & Real-World Impact
Worst Case
Complete application crash and denial of service, potentially affecting multiple users or services.
Likely Case
Application crashes when processing maliciously crafted input, causing service disruption.
If Mitigated
Graceful error handling with descriptive error messages instead of crashes.
🎯 Exploit Status
Exploitation requires ability to influence evaluation environment data, but no authentication needed if input vectors exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.17.7
Vendor Advisory: https://github.com/expr-lang/expr/security/advisories/GHSA-cfpf-hrx2-8rv6
Restart Required: Yes
Instructions:
Update go.mod to require expr v1.17.7 or later
Run 'go get github.com/expr-lang/expr@v1.17.7'
Rebuild and redeploy application
🔧 Temporary Workarounds
Input validation and sanitization
allValidate or sanitize externally supplied data structures before passing to Expr
Panic recovery wrapper
allWrap expression evaluation with panic recovery to prevent full process crash
🧯 If You Can't Patch
- Ensure evaluation environments cannot contain cyclic references
- Implement strict input validation for all data passed to Expr functions
🔍 How to Verify
Check if Vulnerable:
Check go.mod or go.sum for expr versions before 1.17.7Check Version:
grep 'expr-lang/expr' go.modVerify Fix Applied:
Verify expr version is 1.17.7 or later in go.mod📡 Detection & Monitoring
Log Indicators:
- Stack overflow panic messages
- Application crash logs mentioning Expr functions
- Unexpected process termination
Network Indicators:
- Sudden service unavailability
- Increased error rates in API responses
SIEM Query:
process:terminated AND (message:*panic* OR message:*stack*overflow*) AND source:expr