CVE-2025-29786

What it actually does

Unbounded expression input causes the parser to build an arbitrarily large AST, exhausting memory and triggering an OOM crash of the host process.

Why it matters to the business

Applications that accept user-controlled expressions without length limits can be forced offline, producing service outages and requiring manual restarts or scaling events.

How an attack unfolds

An attacker submits a single, extremely long expression string to any endpoint that invokes the Expr parser without prior size validation; the parser allocates nodes for every token until memory is exhausted and the process terminates.

How to fix it

Upgrade expr-lang/expr to version 1.17.0 or later (commit 3be6386f86a53e713a5b083e33582d94710653cc) which enforces compile-time node and memory budgets. Until the upgrade is complete, enforce an explicit maximum expression length (for example 4 KB) and reject or truncate longer inputs before parsing.

How to confirm the fix worked

After upgrade, attempt to compile an expression exceeding the new node budget and confirm the parser returns a controlled error instead of consuming unbounded memory; monitor process RSS and restart behavior under load tests with large inputs.

Typical attack path

1. Identify an application endpoint or API that passes untrusted strings to Expr.Eval or Compile
2. Craft or generate an expression whose length exceeds any implicit limits (tens or hundreds of megabytes)
3. Send the oversized expression in a single request
4. Observe process crash or memory-pressure alerts confirming resource exhaustion

How to detect it

Search application and web-server logs for unusually long request bodies or query parameters containing expression syntax; correlate with sudden memory spikes or OOM termination events in process monitors.

What your security team should do

• Immediately add input-length validation (maximum 4 KB or equivalent node count) to every call site that invokes the Expr parser
• Upgrade all instances of expr-lang/expr to 1.17.0 or newer within the next sprint
• Add memory-usage and OOM-kill alerts for processes that embed the Expr library
• Review downstream dependents to determine breadth of exposure across the ecosystem