CVE-2025-29786: Expr for Go DoS Vulnerability

CVE-2025-29786 Overview

CVE-2025-29786 is a Resource Exhaustion vulnerability in Expr, an expression language and expression evaluation library for Go. Prior to version 1.17.0, the Expr expression parser does not impose limits on input size, allowing an attacker to supply an extremely large expression string that causes the parser to build a massive Abstract Syntax Tree (AST). This unbounded memory allocation can lead to Out-Of-Memory (OOM) conditions, ultimately crashing the affected process.

Critical Impact

Applications using the Expr library without input validation are vulnerable to denial of service attacks through memory exhaustion, potentially causing service disruption and system instability.

Affected Products

• Expr (expr-lang/expr) versions prior to 1.17.0
• Go applications integrating the Expr expression evaluation library without input size restrictions

Discovery Timeline

• 2025-03-17 - CVE-2025-29786 published to NVD
• 2025-03-17 - Last updated in NVD database

Technical Details for CVE-2025-29786

Vulnerability Analysis

This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The core issue lies in the Expr library's parsing mechanism, which processes expression strings without any constraints on input size or AST complexity. When the parser encounters an expression string, it attempts to compile the entire input and generates an AST node for each component of the expression.

In attack scenarios, a malicious actor can craft or submit an arbitrarily large expression string to any application endpoint that uses Expr for expression evaluation. As the parser processes this oversized input, it allocates memory for each AST node without checking cumulative resource consumption. This can rapidly exhaust available memory, leading to an OOM condition that crashes the process.

The vulnerability is network-exploitable with low attack complexity, requiring no privileges or user interaction. However, it only affects confidentiality, integrity, and availability in terms of service disruption—specifically targeting availability through denial of service.

Root Cause

The root cause of CVE-2025-29786 is the absence of compile-time limits on AST node count and memory usage during the expression parsing phase. The parser was designed to handle expressions of any size without safeguards, which is problematic when applications accept untrusted or unvalidated input strings. Without boundaries on resource allocation, the parser continues building the AST until either completion or system memory exhaustion.

Attack Vector

This vulnerability can be exploited remotely over the network. An attacker targeting an application that uses Expr for dynamic expression evaluation can submit a maliciously crafted, extremely large expression string through any input mechanism (API endpoints, form fields, configuration files, etc.). The attack does not require authentication or any special privileges.

The exploitation mechanism works as follows: the oversized expression forces the parser to allocate memory continuously as it builds an increasingly large AST. Since no limits exist on the number of nodes or total memory usage, the parser will attempt to process the entire expression, regardless of length. This memory consumption can grow until the operating system terminates the process due to OOM conditions, effectively causing a denial of service.

For technical implementation details, refer to the GitHub Pull Request #762 which contains the patch introducing resource limits.

Detection Methods for CVE-2025-29786

Indicators of Compromise

• Unusually large memory consumption by applications using the Expr library
• Process crashes or OOM killer invocations coinciding with expression evaluation operations
• Incoming requests containing abnormally long expression strings
• Application logs showing parsing failures or timeouts on expression evaluation

Detection Strategies

• Monitor application memory usage patterns and alert on sudden spikes during expression parsing operations
• Implement request logging to capture and analyze the size of expression strings being submitted
• Deploy application-level monitoring to track AST compilation times and resource consumption
• Review web application firewall (WAF) logs for requests with unusually large payloads targeting expression evaluation endpoints

Monitoring Recommendations

• Configure memory threshold alerts for processes running Expr-based expression evaluation
• Implement request size monitoring at load balancers and API gateways
• Enable detailed logging for expression parsing operations to capture attempted exploitation
• Set up crash dump analysis to identify OOM-related failures linked to expression processing

How to Mitigate CVE-2025-29786

Immediate Actions Required

• Upgrade to Expr version 1.17.0 or later immediately
• Audit all application code to identify where Expr is used for expression evaluation
• Implement input validation to restrict expression string length before parsing
• Review API endpoints and user-facing features that accept expression inputs for potential exposure

Patch Information

The vulnerability has been patched in Expr version 1.17.0. This release introduces compile-time limits on the number of AST nodes and memory usage during parsing, preventing any single expression from exhausting system resources. The fix ensures that extremely deep or large expressions are detected and safely aborted during compilation, avoiding OOM conditions.

For detailed patch information, see the GitHub Security Advisory and the related pull request.

Workarounds

• Impose a maximum character limit on expression strings before passing them to the parser
• Implement application-level validation to reject or truncate expressions exceeding a defined threshold
• Deploy rate limiting on endpoints that accept expression inputs to slow potential exploitation attempts
• Use resource quotas (cgroups, container limits) to constrain memory available to affected processes

# Example: Go application input validation before Expr parsing
# Validate expression length before parsing
MAX_EXPR_LENGTH=10000
# In your application code, check len(expression) < MAX_EXPR_LENGTH before calling expr.Compile()
# Reject or truncate any expression exceeding this limit