CVE-2025-15453 | milvus up to 2.6.7 HTTP Endpoint pkg/util/expr/expr.go expr.Exec code deserialization (Issue 46442)

A vulnerability classified as critical has been found in milvus up to 2.6.7. This vulnerability affects the function expr.Exec of the file pkg/util/expr/expr.go of the component HTTP Endpoint. The manipulation of the argument code leads to deserialization.

This vulnerability is referenced as CVE-2025-15453. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

A fix is planned for the next release 2.6.8.