Expr-Lang Expr vulnerabilities

CVE-2025-68156 [HIGH] CWE-770 CVE-2025-68156: Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several bu Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including `flatten`, `min`, `max`, `mean`, and `median`, perform recursive traversal over user-provided data structures without enforcing a maximum recursion depth. If the evaluation environment contains deeply nested or cyclic

CVE-2025-29786 [HIGH] CWE-770 CVE-2025-29786: Expr is an expression language and expression evaluation for Go. Prior to version 1.17.0, if the Exp Expr is an expression language and expression evaluation for Go. Prior to version 1.17.0, if the Expr expression parser is given an unbounded input string, it will attempt to compile the entire string and generate an Abstract Syntax Tree (AST) node for each part of the expression. In scenarios where input size isn’t limited, a malicious or inadvertent