CVE-2025-68156: 
Grafana vulnerability analysis and mitigation

CVE-2025-68156 is a Denial of Service (DoS) vulnerability in the expr-lang/expr Go expression language library, caused by unbounded recursion in several builtin functions. Prior to version 1.17.7, the functions flatten, min, max, mean, and median perform recursive traversal over user-provided data structures without enforcing a maximum recursion depth, allowing deeply nested or cyclic inputs to exhaust the Go runtime stack and crash the host application. The vulnerability was published on December 16, 2025, and affects all versions of github.com/expr-lang/expr before 1.17.7. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling): the affected builtin functions recursively traverse nested arrays, maps, or structs without any depth guard, allowing the Go call stack to grow unboundedly (GitHub Advisory). An attacker who can influence the evaluation environment — for example, by supplying externally constructed data containing cyclic references (e.g., a slice containing itself) or pathologically deep nesting — can trigger an unrecoverable stack overflow panic that terminates the host process (GitHub PR #870). The attack vector is network-accessible, requires no authentication or user interaction, and is most impactful when Expr evaluates expressions against externally supplied or dynamically constructed environments lacking application-level input validation.

Successful exploitation results in a process-level crash of the host application, constituting a complete availability loss (DoS) with no impact on confidentiality or integrity. Because the Go runtime panic is unrecoverable without explicit panic recovery wrappers, the crash terminates the entire process rather than just the affected goroutine, potentially taking down all services hosted within that process (GitHub Advisory). Downstream products embedding the vulnerable library — including OpenTelemetry Collector, CoreDNS, KEDA, IBM Cloud Pak for Business Automation, and Splunk components — are also affected (Feedly, IBM Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.054%, indicating a low probability of exploitation in the near term. Exploitability is conditional on an attacker being able to inject cyclic or deeply nested data structures into the Expr evaluation environment, which limits the attack surface to applications that accept externally supplied data without sanitization.

1. Identify a target application: Locate an application that uses github.com/expr-lang/expr versions prior to 1.17.7 and evaluates expressions against externally supplied or user-controlled data structures (e.g., a REST API, rule engine, or policy evaluator).
2. Craft a cyclic or deeply nested data structure: Construct a payload containing a cyclic reference (e.g., a JSON array or map that references itself) or a pathologically deep nesting level exceeding the Go runtime stack capacity.
3. Inject the malicious data into the evaluation environment: Submit the crafted data structure through the application's input interface (e.g., HTTP request body, configuration parameter, or API call) so that it is passed as part of the Expr evaluation environment.
4. Trigger a vulnerable builtin function: Ensure the evaluated expression invokes one of the affected functions — flatten, min, max, mean, or median — on the malicious data structure.
5. Achieve DoS: The recursive traversal exceeds the Go runtime stack limit, triggering an unrecoverable stack overflow panic that crashes the host process (GitHub Advisory, GitHub PR #870).

• Logs: Go runtime panic messages in application logs containing runtime: goroutine stack exceeds or stack overflow followed by a goroutine dump; unexpected process termination events in system or container logs.
• Process: Sudden, unexplained crashes of the host application or container restarts (e.g., Kubernetes pod restarts due to OOMKilled or crash loop); absence of graceful shutdown signals preceding the crash.
• Network: Repeated requests to application endpoints that accept user-supplied data structures, particularly those triggering expression evaluation, originating from the same source IP in a short time window.
• Application Behavior: Evaluation errors or panics referencing builtin functions (flatten, min, max, mean, median) in stack traces; crash dumps containing deeply nested or self-referential data structures in the evaluation context (GitHub Advisory).

Upgrade to github.com/expr-lang/expr version 1.17.7 or later, which introduces a builtin.MaxDepth limit (defaulting to 10,000) that causes affected functions to return a descriptive error instead of panicking when the depth is exceeded (GitHub Advisory, GitHub PR #870). For users unable to upgrade immediately, the following workarounds are recommended: (1) ensure evaluation environments cannot contain cyclic references; (2) validate and sanitize externally supplied data structures before passing them to Expr; (3) wrap expression evaluation with Go panic recovery (recover()) as a last-resort measure to prevent full process crashes. Applications with legitimate deep structures can customize the limit via builtin.MaxDepth after upgrading. Downstream products such as IBM Cloud Pak for Business Automation, Red Hat OpenTelemetry Collector, and CoreDNS packages have also released updates addressing this dependency (IBM Advisory, Red Hat RHSA-2025:23664).

The vulnerability was reported by researcher thevilledev and patched by maintainer antonmedv via PR #870 on December 4, 2025, with the advisory published on December 16, 2025 (GitHub PR #870). Multiple downstream projects, including the OpenTelemetry Collector Contrib project, filed issues to track the vulnerable dependency shortly after disclosure (GitHub PR #870). Vendor responses followed from Red Hat, IBM, Microsoft (Azure Linux packages), SUSE, and Amazon Linux, all issuing security advisories or updated packages incorporating the fix (IBM Advisory, Feedly).