Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-29786

22
FAUCET Score

CVE-2025-29786 describes an excessive memory usage vulnerability in the Expr Go expression language library prior to version 1.17.0. An attacker can craft an extremely large expression, leading to an Out-Of-Memory (OOM) crash as the parser attempts to build an unbounded Abstract Syntax Tree (AST). This vulnerability is rated as HIGH severity (CVSS 7.5), with a network attack vector and high availability impact, but no confidentiality or integrity impact. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
Expr-LangExpr
< 1.17.0CNA affected

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.58%
Probability of exploitation in next 30 days
EPSS Percentile
44.1%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0058 is in the 21st percentile among its peer group of 51,553 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (49)

gopatch availablevia ghsa
Product: github.com/expr-lang/exprFixed in: 1.17.0
microsoftpatch availablevia msrc
Product: azl3 coredns 1.11.4-6 on Azure Linux 3.0Fixed in: 1.11.4-4
microsoftpatch availablevia msrc
Product: azl3 coredns 1.11.4-4 on Azure Linux 3.0Fixed in: 1.11.4-4
microsoftpatch availablevia msrc
Product: cbl2 coredns 1.11.1-18 on CBL Mariner 2.0Fixed in: 1.11.1-17
microsoftpatch availablevia msrc
Product: cbl2 coredns 1.11.1-17 on CBL Mariner 2.0Fixed in: 1.11.1-17
microsoftpatch availablevia msrc
Product: azl3 keda 2.14.1-4 on Azure Linux 3.0Fixed in: 2.14.1-4
microsoftpatch availablevia msrc
Product: azl3 keda 2.14.1-7 on Azure Linux 3.0Fixed in: 2.14.1-4
microsoftpatch availablevia msrc
Product: azl3 ig 0.37.0-3 on Azure Linux 3.0Fixed in: 0.37.0-3
microsoftpatch availablevia msrc
Product: azl3 ig 0.37.0-4 on Azure Linux 3.0Fixed in: 0.37.0-3
microsoftpatch availablevia msrc
Product: 19410-16823Fixed in: 1.11.1-17
microsoftpatch availablevia msrc
Product: 19412-17084Fixed in: 2.14.1-4
microsoftpatch availablevia msrc
Product: 19347-17084Fixed in: 2.14.1-4
microsoftpatch availablevia msrc
Product: 19413-17084Fixed in: 0.37.0-3
microsoftpatch availablevia msrc
Product: 19342-17084Fixed in: 0.37.0-3
microsoftpatch availablevia msrc
Product: 19867-17086Fixed in: 1.11.1-17
microsoftpatch availablevia msrc
Product: 19411-17084Fixed in: 1.11.4-4
microsoftpatch availablevia msrc
Product: 19908-17084Fixed in: 1.11.4-4
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift distributed tracing 3.5.1Fixed in: rhosdt/opentelemetry-collector-rhel8:sha256:2cd5fdc0d5efee8f9ced0cf8389c000c245ca5368098c5ce0bc2b6241ac6a455
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift distributed tracing 3.6.0Fixed in: rhosdt/opentelemetry-rhel8-operator:sha256:c105cc315f0cac6c42fb3434f6e3c87e58e0dfb25f36ea6fb19016acbf888b86
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift GitOps 1.15Fixed in: openshift-gitops-1/gitops-rhel8:v1.15.2-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: opentelemetry-collector-0:0.107.0-9.el10_0
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: opentelemetry-collector-0:0.107.0-8.el9_5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: opentelemetry-collector-0:0.107.0-8.el9_6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9.4 Extended Update SupportFixed in: opentelemetry-collector-0:0.107.0-7.el9_4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift GitOps 1.15Fixed in: openshift-gitops-1/argocd-extensions-rhel8:v1.15.2-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift GitOps 1.15Fixed in: openshift-gitops-1/argocd-rhel8:v1.15.2-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift GitOps 1.15Fixed in: openshift-gitops-1/argocd-rhel9:v1.15.2-1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift GitOps 1.15Fixed in: openshift-gitops-1/argo-rollouts-rhel8:v1.15.2-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift GitOps 1.15Fixed in: openshift-gitops-1/console-plugin-rhel8:v1.15.2-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift GitOps 1.15Fixed in: openshift-gitops-1/dex-rhel8:v1.15.2-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift GitOps 1.15Fixed in: openshift-gitops-1/gitops-operator-bundle:v1.15.2-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift GitOps 1.15Fixed in: openshift-gitops-1/gitops-rhel8-operator:v1.15.2-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift GitOps 1.15Fixed in: openshift-gitops-1/must-gather-rhel8:v1.15.2-4
View patch
redhatpatch availablevia redhat_api
Product: Custom Metric Autoscaler operator for Red Hat Openshift 2.15Fixed in: custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9:sha256:0166a9dc52e4b24030198460a061dc4fc649e6007b99213a38496aada2aaaba6
View patch
redhatpatch availablevia redhat_api
Product: Custom Metric Autoscaler operator for Red Hat Openshift 2.15Fixed in: custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9:sha256:e25cd6d10cc023428bfb3c82a8a59ff0620ac835a326a01ef5ea79688cbfc800
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift distributed tracing 3.5.1Fixed in: rhosdt/tempo-rhel8:sha256:7a173206a8aca1d9f21cdbe1dfd87ed89953b573f3b9c2e7caa84e7d575bbba0
View patch
redhatno patchvia redhat_api
Product: Red Hat OpenShift distributed tracing 3Fixed in: rhosdt/tempo-rhel8-operator
redhatno patchvia redhat_api
Product: Red Hat OpenShift distributed tracing 3Fixed in: rhosdt/opentelemetry-target-allocator-rhel8
redhatno patchvia redhat_api
Product: Red Hat OpenShift distributed tracing 3Fixed in: rhosdt/opentelemetry-operator-bundle
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel8
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-ml-pipelines-persistenceagent-v2-rhel8
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-ml-pipelines-launcher-rhel8
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-ml-pipelines-driver-rhel8
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-ml-pipelines-api-server-v2-rhel8
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8
redhatno patchvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-data-science-pipelines-argo-argoexec-rhel8
redhatno patchvia redhat_api
Product: Deployment Validation OperatorFixed in: deployment-validation-operator-container
redhatno patchvia redhat_api
Product: Custom Metric Autoscaler operator for Red Hat OpenshiftFixed in: custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8
redhatno patchvia redhat_api
Product: Custom Metric Autoscaler operator for Red Hat OpenshiftFixed in: custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel8

Vendor Advisories (3)

goGHSA-93mq-9ffx-83m2high

Memory Exhaustion in Expr Parser with Unrestricted Input

Mar 17, 2025
redhatCVE-2025-29786Important

github.com/expr-lang/expr: Memory Exhaustion in Expr Parser with Unrestricted Input

Mar 17, 2025
microsoft2025-Mar/CVE-2025-29786Important

Memory Exhaustion in Expr Parser with Unrestricted Input

Mar 11, 2025

References

github.com / expr-lang/expr/commit/0d19441454426d2f58edb22c31f3ba5f99c7a26e
github.com / expr-lang/expr/pull/762
github.com / expr-lang/expr/security/advisories/GHSA-93mq-9ffx-83m2