StackRadar

CVE-2025-68156

High

Advisory

Published 16 Dec 2025In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
36th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
64
of 17,781 indexed, latest versions
Container images
64
deployed by those charts
Fix available
1 of 1
affected package

Expr has Denial of Service via Unbounded Recursion in Builtin Functions

Carried by container images the latest versions of 64 of 17,781 indexed charts deploy, on 64 images.

Affected packageAffected versionsFixed inImages
github.com/expr-lang/exprgolangv1.16.0, v1.16.1, v1.16.2, v1.16.5+6 more1.17.764
OSV records
GHSA-cfpf-hrx2-8rv6
Also known as
GO-2025-4245

Charts affected

64 by stars
ChartLatestAffected imagesRadar Score
openebsopenebsOfficialVerified publisher4.6.11 of 35See more

openebs openebs 4.6.1

1 of the 35 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
grafana/alloy:v1.8.17790f6f7fbd8
github.com/expr-lang/expr@v1.17.0
1.17.7

Open the chart page →

23,894
rocketchatrocketchat-server7.0.21 of 12See more

rocketchat rocketchat-server 7.0.2

1 of the 12 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
natsio/nats-box:0.19.28031d190c7ee
github.com/expr-lang/expr@v1.17.6
1.17.7

Open the chart page →

12,279
grafana-agentgrafana0.44.21 of 2See more

grafana-agent grafana 0.44.2

1 of the 2 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
grafana/agent:v0.44.23364714a2f64
github.com/expr-lang/expr@v1.16.1
1.17.7

Open the chart page →

3,475
pyroscopegrafana2.3.11 of 3See more

pyroscope grafana 2.3.1

1 of the 3 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
grafana/alloy:v1.12.2f94b1c82957a
github.com/expr-lang/expr@v1.17.6
1.17.7

Open the chart page →

3,157
argocdnicklasfrahm-argocdVerified publisher0.3.01 of 2See more

argocd nicklasfrahm-argocd 0.3.0

1 of the 2 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
github.com/expr-lang/expr@v1.17.5
1.17.7

Open the chart page →

5,240
k8s-infrasignoz0.17.11 of 1See more

k8s-infra signoz 0.17.1

1 of the 1 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.139.0faf125d656fa
github.com/expr-lang/expr@v1.17.6
1.17.7

Open the chart page →

1,039
routercosmo-routerOfficialVerified publisher0.18.01 of 1See more

router cosmo-router 0.18.0

1 of the 1 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/router:0.243.05afcab98d9d7
github.com/expr-lang/expr@v1.17.3
1.17.7

Open the chart page →

1,663
cosmocosmo-platformOfficialVerified publisher0.20.01 of 10See more

cosmo cosmo-platform 0.20.0

1 of the 10 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/otelcollector:0.18.15a6fe78d4d15
github.com/expr-lang/expr@v1.16.9
1.17.7

Open the chart page →

28,839
uptraceuptrace2.0.21 of 2See more

uptrace uptrace 2.0.2

1 of the 2 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
uptrace/uptrace:2.0.234a02c3b2d12
github.com/expr-lang/expr@v1.17.2
1.17.7

Open the chart page →

1,619
kedaarieotechVerified publisher0.1.02 of 3See more

keda arieotech 0.1.0

2 of the 3 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
ghcr.io/kedacore/keda:2.16.002348a19aeae
github.com/expr-lang/expr@v1.16.9
1.17.7
ghcr.io/kedacore/keda-metrics-apiserver:2.16.073a2ebae4413
github.com/expr-lang/expr@v1.16.9
1.17.7

Open the chart page →

2,276
spectrechronicleVerified publisher0.3.81 of 1See more

spectre chronicle 0.3.8

1 of the 1 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
ghcr.io/chronicleprotocol/spectre:0.68.34e872bc016e8
github.com/expr-lang/expr@v1.17.6
1.17.7

Open the chart page →

1,515
cluster-setupcluster-setup1.5.01 of 8See more

cluster-setup cluster-setup 1.5.0

1 of the 8 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.0.395b5cf7ba6fe
github.com/expr-lang/expr@v1.16.9
1.17.7

Open the chart page →

10,037
meta-monitoringgrafana1.3.01 of 2See more

meta-monitoring grafana 1.3.0

1 of the 2 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
grafana/alloy:v1.4.306bdcbb51fc2
github.com/expr-lang/expr@v1.16.9
1.17.7

Open the chart page →

3,518
joylive-injectorjoyliveOfficialVerified publisher1.3.51 of 2See more

joylive-injector joylive 1.3.5

1 of the 2 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
otel/opentelemetry-collector:0.100.09e36620d6c2c
github.com/expr-lang/expr@v1.16.5
1.17.7

Open the chart page →

1,273
k8s-grafana-stackk8s-grafana-stackVerified publisher0.2.321 of 17See more

k8s-grafana-stack k8s-grafana-stack 0.2.32

1 of the 17 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
grafana/tempo:2.9.065a578975943
github.com/expr-lang/expr@v1.17.5
1.17.7

Open the chart page →

15,418
mw-kube-agent-v2middleware-labsVerified publisher2.8.61 of 1See more

mw-kube-agent-v2 middleware-labs 2.8.6

1 of the 1 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/mw-kube-agent:1.12.09c7bc0f9bb35
github.com/expr-lang/expr@v1.16.9
1.17.7

Open the chart page →

4,137
octopuso7studios-octopus-helm-chartsOfficialVerified publisher1.2.31 of 5See more

octopus o7studios-octopus-helm-charts 1.2.3

1 of the 5 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
natsio/nats-box:0.18.0abdc9f9f0120
github.com/expr-lang/expr@v1.17.2
1.17.7

Open the chart page →

6,091
wireguardslybase-wireguardVerified publisher2.0.61 of 1See more

wireguard slybase-wireguard 2.0.6

1 of the 1 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
linuxserver/wireguard:1.0.20260223-r0-ls122dca67384e3e9
github.com/expr-lang/expr@v1.17.6
1.17.7

Open the chart page →

436
wireguardalexpressoVerified publisher0.1.31 of 2See more

wireguard alexpresso 0.1.3

1 of the 2 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
linuxserver/wireguard:latestbf03578ef731
github.com/expr-lang/expr@v1.17.6
1.17.7

Open the chart page →

780
argocdargo-helm-charts1.0.01 of 3See more

argocd argo-helm-charts 1.0.0

1 of the 3 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.14.115fc69e31c755
github.com/expr-lang/expr@v1.17.0
1.17.7

Open the chart page →

7,300
argo-workflowsargo-helm-charts1.0.02 of 2See more

argo-workflows argo-helm-charts 1.0.0

2 of the 2 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
quay.io/argoproj/argocli:v3.7.16efd1cb89dc1
github.com/expr-lang/expr@v1.17.5
1.17.7
quay.io/argoproj/workflow-controller:v3.7.166388d1b2f08
github.com/expr-lang/expr@v1.17.5
1.17.7

Open the chart page →

1,826
pyroscopebook-k8sinfra-v21.10.01 of 3See more

pyroscope book-k8sinfra-v2 1.10.0

1 of the 3 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
grafana/alloy:v1.1.1c3dac4e26471
github.com/expr-lang/expr@v1.16.5
1.17.7

Open the chart page →

3,244
tempobook-k8sinfra-v21.10.31 of 1See more

tempo book-k8sinfra-v2 1.10.3

1 of the 1 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
grafana/tempo:2.5.0f0200a9bff6d
github.com/expr-lang/expr@v1.16.2
1.17.7

Open the chart page →

1,859
catalyst-agentscatalyst-agents0.1.301 of 18See more

catalyst-agents catalyst-agents 0.1.30

1 of the 18 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
grafana/tempo:2.5.0f0200a9bff6d
github.com/expr-lang/expr@v1.16.2
1.17.7

Open the chart page →

15,027
goferchronicleVerified publisher0.4.41 of 1See more

gofer chronicle 0.4.4

1 of the 1 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
ghcr.io/chronicleprotocol/gofer:0.613915d2e41e04
github.com/expr-lang/expr@v1.17.0
1.17.7

Open the chart page →

721
spirechronicleVerified publisher0.3.61 of 1See more

spire chronicle 0.3.6

1 of the 1 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
ghcr.io/chronicleprotocol/spire:0.68.379df4fb20322
github.com/expr-lang/expr@v1.17.6
1.17.7

Open the chart page →

1,515
dapr-agentsdapr-agents-devVerified publisher0.1.51 of 31See more

dapr-agents dapr-agents-dev 0.1.5

1 of the 31 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
grafana/tempo:2.9.065a578975943
github.com/expr-lang/expr@v1.17.5
1.17.7

Open the chart page →

22,193
direktivdirektivVerified publisher0.10.01 of 6See more

direktiv direktiv 0.10.0

1 of the 6 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-k8s:0.120.01e45d9483faa
github.com/expr-lang/expr@v1.16.9
1.17.7

Open the chart page →

3,470
corednsdoubanVerified publisher1.39.21 of 1See more

coredns douban 1.39.2

1 of the 1 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
coredns/coredns:1.12.040384aa1f5ea
github.com/expr-lang/expr@v1.16.9
1.17.7

Open the chart page →

1,132
kube-ecp-stackemqx-operator2.5.11 of 16See more

kube-ecp-stack emqx-operator 2.5.1

1 of the 16 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
emqxecp/otelcol:2.5.04c31d9bec846
github.com/expr-lang/expr@v1.16.9
1.17.7

Open the chart page →

23,685
farm-observabilityfarm-observabilityOfficialVerified publisher0.27.22 of 18See more

farm-observability farm-observability 0.27.2

2 of the 18 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
grafana/alloy:v1.12.2f94b1c82957a
github.com/expr-lang/expr@v1.17.6
1.17.7
grafana/tempo:2.9.065a578975943
github.com/expr-lang/expr@v1.17.5
1.17.7

Open the chart page →

13,255
galoy-depsgaloymoney0.10.201 of 9See more

galoy-deps galoymoney 0.10.20

1 of the 9 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-k8s:0.111.032b3c8296dcc
github.com/expr-lang/expr@v1.16.9
1.17.7

Open the chart page →

11,961
galoy-depsgaloymoney20.10.201 of 9See more

galoy-deps galoymoney2 0.10.20

1 of the 9 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-k8s:0.111.032b3c8296dcc
github.com/expr-lang/expr@v1.16.9
1.17.7

Open the chart page →

11,961
glassflow-etlglassflowVerified publisher0.5.212 of 16See more

glassflow-etl glassflow 0.5.21

2 of the 16 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
natsio/nats-box:0.19.28031d190c7ee
github.com/expr-lang/expr@v1.17.6
1.17.7
otel/opentelemetry-collector-contrib:0.108.0923eb1cfae32
github.com/expr-lang/expr@v1.16.9
1.17.7

Open the chart page →

12,056
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.114.037fa87091cfa
github.com/expr-lang/expr@v1.16.9
1.17.7

Open the chart page →

49,025
grafana-samplinggrafana1.1.71 of 2See more

grafana-sampling grafana 1.1.7

1 of the 2 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
grafana/alloy:v1.11.38c7256f412fe
github.com/expr-lang/expr@v1.17.6
1.17.7

Open the chart page →

3,318
pyroscope-monitoringgrafana0.1.11 of 6See more

pyroscope-monitoring grafana 0.1.1

1 of the 6 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
grafana/otel-lgtm:0.11.1009d8c3ce4f3a
github.com/expr-lang/expr@v1.17.2
1.17.7

Open the chart page →

8,188
svacerhelm-svacer0.6.01 of 1See more

svacer helm-svacer 0.6.0

1 of the 1 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
ispras/svacer:11-2-042aa9fa9f189
github.com/expr-lang/expr@v1.16.9
1.17.7

Open the chart page →

6,015
ilum-otel-collectorilumVerified publisher0.1.01 of 1See more

ilum-otel-collector ilum 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.113.05ac3e0ba2b0b
github.com/expr-lang/expr@v1.16.9
1.17.7

Open the chart page →

1,384
corednsjouveVerified publisher1.45.01 of 1See more

coredns jouve 1.45.0

1 of the 1 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
coredns/coredns:1.13.19b9128672209
github.com/expr-lang/expr@v1.17.6
1.17.7

Open the chart page →

887
kagentkagent0.10.11 of 6See more

kagent kagent 0.10.1

1 of the 6 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
ghcr.io/kagent-dev/kagent/tools:0.2.150b431281d3e
github.com/expr-lang/expr@v1.16.9
1.17.7

Open the chart page →

2,900
kubeflowkromanow94-kubeflow0.5.14 of 30See more

kubeflow kromanow94-kubeflow 0.5.1

4 of the 30 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
gcr.io/ml-pipeline/api-server:2.3.039661bd823e8
github.com/expr-lang/expr@v1.16.0
1.17.7
gcr.io/ml-pipeline/cache-server:2.3.0293941ee4f65
github.com/expr-lang/expr@v1.16.0
1.17.7
gcr.io/ml-pipeline/persistenceagent:2.3.0109ac1b38c41
github.com/expr-lang/expr@v1.16.0
1.17.7
gcr.io/ml-pipeline/scheduledworkflow:2.3.0f7e67e0bc071
github.com/expr-lang/expr@v1.16.0
1.17.7

Open the chart page →

70,530
argo-workflowskubeblocksVerified publisher0.40.142 of 2See more

argo-workflows kubeblocks 0.40.14

2 of the 2 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
quay.io/argoproj/argocli:v3.5.591b9825f09a8
github.com/expr-lang/expr@v1.16.0
1.17.7
quay.io/argoproj/workflow-controller:v3.5.56ab0da144235
github.com/expr-lang/expr@v1.16.0
1.17.7

Open the chart page →

2,871
kubiya-runnerkubiya-helm-chartsOfficialVerified publisher0.9.41 of 9See more

kubiya-runner kubiya-helm-charts 0.9.4

1 of the 9 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
grafana/alloy:v1.5.101a63f4e032c
github.com/expr-lang/expr@v1.16.9
1.17.7

Open the chart page →

20,204
tempo-distributedloafoe1.20.11 of 2See more

tempo-distributed loafoe 1.20.1

1 of the 2 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
grafana/tempo:2.6.0f55a8a1937ff
github.com/expr-lang/expr@v1.16.2
1.17.7

Open the chart page →

2,020
vcluster-headloftVerified publisher0.0.0-035ec6e1 of 2See more

vcluster-head loft 0.0.0-035ec6e

1 of the 2 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/kubernetes:v1.35.090097a08b87c
github.com/expr-lang/expr@v1.17.6
1.17.7

Open the chart page →

1,269
nightingalelogic3579Verified publisher0.3.11 of 6See more

nightingale logic3579 0.3.1

1 of the 6 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
flashcatcloud/nightingale:8.5.1421acb36181b
github.com/expr-lang/expr@v1.16.1
1.17.7

Open the chart page →

8,938
magistralamagistrala-devopsVerified publisher0.16.21 of 42See more

magistrala magistrala-devops 0.16.2

1 of the 42 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
natsio/nats-box:0.14.31cc420186664
github.com/expr-lang/expr@v1.16.1
1.17.7

Open the chart page →

24,400
mayastormayastorVerified publisher2.12.11 of 31See more

mayastor mayastor 2.12.1

1 of the 31 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
grafana/alloy:v1.8.17790f6f7fbd8
github.com/expr-lang/expr@v1.17.0
1.17.7

Open the chart page →

21,064
cognativemyaVerified publisher0.2403.31 of 3See more

cognative mya 0.2403.3

1 of the 3 container images this version deploys carry CVE-2025-68156.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
github.com/expr-lang/expr@v1.16.1
1.17.7

Open the chart page →

7,309

Container images carrying it

64 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/loft-sh/kubernetes:v1.35.090097a08b87c
github.com/expr-lang/expr@v1.17.6
1.17.7
1
ghcr.io/middleware-labs/mw-kube-agent:1.12.09c7bc0f9bb35
github.com/expr-lang/expr@v1.16.9
1.17.7
1
ghcr.io/openlit/openlit:1.24.02434560e8f0e
github.com/expr-lang/expr@v1.17.6
1.17.7
1
ghcr.io/wundergraph/cosmo/otelcollector:0.18.15a6fe78d4d15
github.com/expr-lang/expr@v1.16.9
1.17.7
1
ghcr.io/wundergraph/cosmo/router:0.243.05afcab98d9d7
github.com/expr-lang/expr@v1.17.3
1.17.7
1
public.ecr.aws/aws-observability/aws-otel-collector:v0.43.38aa9ea5f67b8
github.com/expr-lang/expr@v1.17.0
1.17.7
1
quay.io/argoproj/argocd:v3.0.395b5cf7ba6fe
github.com/expr-lang/expr@v1.16.9
1.17.7
1
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
github.com/expr-lang/expr@v1.17.5
1.17.7
1
quay.io/argoproj/argocli:v3.7.16efd1cb89dc1
github.com/expr-lang/expr@v1.17.5
1.17.7
1
quay.io/argoproj/argocli:v3.5.591b9825f09a8
github.com/expr-lang/expr@v1.16.0
1.17.7
1
quay.io/argoproj/workflow-controller:v3.7.166388d1b2f08
github.com/expr-lang/expr@v1.17.5
1.17.7
1
quay.io/argoproj/workflow-controller:v3.5.56ab0da144235
github.com/expr-lang/expr@v1.16.0
1.17.7
1
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
github.com/expr-lang/expr@v1.17.6
1.17.7
1
registry.k8s.io/coredns/coredns:v1.13.294caebb89dcf
github.com/expr-lang/expr@v1.17.6
1.17.7
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.