expr vulnerabilities

2 known vulnerabilities in expr from Expr-lang. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  expr: Allocation of Resources Without Limits or Throttling

  CVE-2025-68156Dec 16, 2025Expr-lang

  Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including `flatten`, `min`, `max`, `mean`, and `median`, perform recursive traversal over user-provided data structures without enforci

• 7.5 High severity

  expr: Allocation of Resources Without Limits or Throttling

  CVE-2025-29786Mar 17, 2025Expr-lang

  Expr is an expression language and expression evaluation for Go. Prior to version 1.17.0, if the Expr expression parser is given an unbounded input string, it will attempt to compile the entire string and generate an Abstract Syntax Tree (AST) node for each pa