Detections
Analytics

SCA: security update for github.com/expr-lang/expr (GHSA-cfpf-hrx2-8rv6)

high Tenable Self-Hosted Container Security Plugin ID 436408

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin
 functions in Expr, including `flatten`, `min`, `max`, `mean`, and `median`, perform recursive traversal
 over user-provided data structures without enforcing a maximum recursion depth. If the evaluation
 environment contains deeply nested or cyclic data structures, these functions may recurse indefinitely
 until exceed the Go runtime stack limit. This results in a stack overflow panic, causing the host
 application to crash. While exploitability depends on whether an attacker can influence or inject cyclic
 or pathologically deep data into the evaluation environment, this behavior represents a denial-of-service
 (DoS) risk and affects overall library robustness. Instead of returning a recoverable evaluation error,
 the process may terminate unexpectedly. In affected versions, evaluation of expressions that invoke
 certain builtin functions on untrusted or insufficiently validated data structures can lead to a process-
 level crash due to stack exhaustion. This issue is most relevant in scenarios where Expr is used to
 evaluate expressions against externally supplied or dynamically constructed environments; cyclic
 references (directly or indirectly) can be introduced into arrays, maps, or structs; and there are no
 application-level safeguards preventing deeply nested input data. In typical use cases with controlled,
 acyclic data, the issue may not manifest. However, when present, the resulting panic can be used to
 reliably crash the application, constituting a denial of service. The issue has been fixed in the v1.17.7
 versions of Expr. The patch introduces a maximum recursion depth limit for affected builtin functions.
 When this limit is exceeded, evaluation aborts gracefully and returns a descriptive error instead of
 panicking. Additionally, the maximum depth can be customized by users via `builtin.MaxDepth`, allowing
 applications with legitimate deep structures to raise the limit in a controlled manner. Users are strongly
 encouraged to upgrade to the patched release, which includes both the recursion guard and comprehensive
 test coverage to prevent regressions. For users who cannot immediately upgrade, some mitigations are
 recommended. Ensure that evaluation environments cannot contain cyclic references, validate or sanitize
 externally supplied data structures before passing them to Expr, and/or wrap expression evaluation with
 panic recovery to prevent a full process crash (as a last-resort defensive measure). These workarounds
 reduce risk but do not fully eliminate the issue without the patch. (CVE-2025-68156)

See Also

https://github.com/advisories/GHSA-cfpf-hrx2-8rv6

Plugin Details

Severity: High

ID: 436408

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 12/17/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.73

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2025-68156

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 12/16/2025

Vulnerability Publication Date: 12/16/2025

Reference Information

CVE: CVE-2025-68156

cwe: CWE-770