{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"golang-github-antonmedv-expr","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":[],"id":"tcs_01M5NN93RRVTTXPD4SS56BXQZW","modified_at":"2026-09-01T20:05:45.980448205Z","published_at":"2025-03-17T14:15:22.237Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2025-29786","https://security-tracker.debian.org/tracker/CVE-2025-29786"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2025-29786#Debian:14/golang-github-antonmedv-expr","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2025-29786"}],"summary":"Expr is an expression language and expression evaluation for Go. Prior to version 1.17.0, if the Expr expression parser is given an unbounded input string, it will attempt to compile the entire string"}