Expr-lang vulnerabilities
We track 2 vulnerabilities in Expr-lang products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on December 16, 2025.
2vulnerabilities
0critical
2high
0exploited
7.5average CVSS score
Latest Expr-lang vulnerabilities
- 7.5 High severity
expr: Allocation of Resources Without Limits or Throttling
Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including `flatten`, `min`, `max`, `mean`, and `median`, perform recursive traversal over user-provided data structures without enforci
- 7.5 High severity
expr: Allocation of Resources Without Limits or Throttling
Expr is an expression language and expression evaluation for Go. Prior to version 1.17.0, if the Expr expression parser is given an unbounded input string, it will attempt to compile the entire string and generate an Abstract Syntax Tree (AST) node for each pa