CVE-2025-68156

Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including flatten, min, max, mean, and median, perform recursive traversal over user-provided data structures without enforcing a maximum recursion depth. If the evaluation...

CVE-2025-68156 Expr has Denial of Service via Unbounded Recursion in Builtin Functions

Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including flatten, min, max, mean, and median, perform recursive traversal over user-provided data structures without enforcing a maximum recursion depth. If the evaluation...

CVE-2025-68156

Expr (Go library) contains a DoS risk in builtins such as flatten, min, max, mean, and median due to potential unbounded recursion on deeply nested or cyclic data. A fix was released in v1.17.7 introducing a maximum recursion depth limit; users can customize it via builtin.MaxDepth. The CVE conte...

CVE-2025-68156 Expr has Denial of Service via Unbounded Recursion in Builtin Functions

Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including flatten, min, max, mean, and median, perform recursive traversal over user-provided data structures without enforcing a maximum recursion depth. If the evaluation...

EUVD-2025-203688

In the Linux kernel, the following vulnerability has been resolved: bpf: account for current allocated stack depth in widenimprecisescalars The usage pattern for widenimprecisescalars looks as follows: prevst = findpreventryenv, ...; queuedst = pushstack...; widenimprecisescalarsenv, prevst,...

CVE-2025-68208

In the Linux kernel, the following vulnerability has been resolved: bpf: account for current allocated stack depth in widenimprecisescalars The usage pattern for widenimprecisescalars looks as follows: prevst = findpreventryenv, ...; queuedst = pushstack...; widenimprecisescalarsenv, prevst,...

CVE-2025-68208

In the Linux kernel, the following vulnerability has been resolved: bpf: account for current allocated stack depth in widenimprecisescalars The usage pattern for widenimprecisescalars looks as follows: prevst = findpreventryenv, ...; queuedst = pushstack...; widenimprecisescalarsenv, prevst,...

UBUNTU-CVE-2025-68208

In the Linux kernel, the following vulnerability has been resolved: bpf: account for current allocated stack depth in widenimprecisescalars The usage pattern for widenimprecisescalars looks as follows: prevst = findpreventryenv, ...; queuedst = pushstack...; widenimprecisescalarsenv, prevst,...

CVE-2025-68208

CVE-2025-68208 is a Linux kernel vulnerability in the BPF subsystem. The issue arises from how widen_imprecise_scalars() accounts for current allocated stack depth when previous and queued stack frames differ in depth, which can lead to out-of-bounds accesses to bpf_verifier_state->frame[*]-&g...

CVE-2025-68208 bpf: account for current allocated stack depth in widen_imprecise_scalars()

In the Linux kernel, the following vulnerability has been resolved: bpf: account for current allocated stack depth in widenimprecisescalars The usage pattern for widenimprecisescalars looks as follows: prevst = findpreventryenv, ...; queuedst = pushstack...; widenimprecisescalarsenv, prevst,...

CVE-2025-68208 bpf: account for current allocated stack depth in widen_imprecise_scalars()

In the Linux kernel, the following vulnerability has been resolved: bpf: account for current allocated stack depth in widenimprecisescalars The usage pattern for widenimprecisescalars looks as follows: prevst = findpreventryenv, ...; queuedst = pushstack...; widenimprecisescalarsenv, prevst,...

Hitachi Energy AFS, AFR and AFF Series

RISK EVALUATION Successful exploitation of this vulnerability could compromise the integrity of the product data and disrupt its availability. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize...

Johnson Controls PowerG, IQPanel and IQHub (Update A)

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to read or write encrypted traffic or perform a replay attack. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:...

Expr 安全漏洞

Expr is an expression language and expression evaluation for Go open-sourced by Expr. A security vulnerability exists in versions of Expr prior to 1.17.7, which stems from multiple built-in functions that do not enforce maximum recursion depth, potentially resulting in a stack overflow and proces...

PT-2025-51779

Name of the Vulnerable Software and Affected Versions Expr versions prior to 1.17.7 Description The Expr library, used for expression language and evaluation in Go, contains a flaw where certain builtin functions – including flatten, min, max, mean, and median – can cause a denial of service. The...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from widenimprecisescalars not taking into account the currently allocated stack depth, which could lead to...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the psdParser::ReadImageData function due to improper verification of depth field while computing the number of bytes per row lineSize directly from PSD header values. An attacker can cause the application...

Exploit for CVE-2025-66478

monorepo-nextjs-npm-nested-versions - VULNERABLE CVE-2025-664...

RHEL 8 : expat (RHSA-2025:22842)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:22842 advisory. Expat is a C library for parsing XML documents. Security Fixes: expat: internal entity expansion CVE-2013-0340 expat: integer overflow in t...

Sunbird DCIM dcTrack and Power IQ

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access or steal credentials. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize...