VULNERABILITY INTELLIGENCE

CVE-2025-68156

CVSS score7.5 HIGH

EPSS probability0.42%

CISA KEVNot currently listed

Published2025-12-16

Last modified2026-10-13

Description

Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including `flatten`, `min`, `max`, `mean`, and `median`, perform recursive traversal over user-provided data structures without enforcing a maximum recursion depth. If the eva…