A critical vulnerability in the Expr library allows unauthenticated attackers to cause a process-level crash via stack exhaustion through the injection of pathologically deep or cyclic data.

This vulnerability involves improper resource management (CWE-770) where built-in functions such as flatten, min, and max fail to enforce recursion depth limits. An unauthenticated attacker can trigger a Go runtime stack overflow by providing malicious, deeply nested, or cyclic data structures to the expression evaluator.

The exploitation of this flaw leads to an unexpected termination of the host application, resulting in a denial-of-service. With a CVSS score of 7.5, this represents a significant risk to service availability, particularly for systems that rely on Expr to process untrusted or externally supplied expressions. Frequent crashes can disrupt business operations, degrade user experience, and force manual intervention to restore service functionality.

Immediate Action: Update the Expr library to version 1.17.7 or later to implement necessary recursion depth constraints.

Proactive Monitoring: Review application logs for abnormal panic signals or sudden service restarts that correlate with external data processing requests.

Compensating Controls: Implement strict input validation or sanitization to prevent the submission of excessively nested or cyclic data structures to the evaluation environment.

Public Exploit Available: No

Given the potential for unauthenticated denial-of-service, organizations utilizing the Expr library should prioritize updating to version 1.17.7 immediately. Verifying that all downstream applications have incorporated the patched dependency is essential to maintaining system stability and preventing service disruption.