CoreCVE
Back

HIGH

github.com/sirupsen/logrus: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload

Published Dec 4, 2025

Description

A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.

Affected products

Remediation

Red Hat statement

This vulnerability is categorized as Moderate because its impact is limited to the logging subsystem and requires a specific, non-default usage pattern to trigger—namely, sending a single unbounded line exceeding 64KB through Entry.Writer(). Most Logrus deployments do not expose this interface directly to attacker-controlled input, which raises the attack complexity and reduces realistic exploitability. Additionally, the flaw does not affect confidentiality or integrity, nor does it allow code execution or privilege escalation. The failure results in a controlled degradation of availability (logging becoming non-functional), rather than a broader application outage or systemic compromise. These constrained conditions and limited real-world impact justify treating the issue as moderate rather than important.

Red Hat mitigation

Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.

Weaknesses (1)

CWE-400

Uncontrolled Resource Consumption

References (15)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Dec 4, 2025
Updated Dec 5, 2025
Reserved Nov 18, 2025
Link CVE-2025-65637
CISA Vulnrichment
Updated Dec 5, 2025
NVD
Status Analyzed
Modified Jun 17, 2026
Link CVE-2025-65637
Red Hat
Severity Moderate
Public date Dec 4, 2025
Links CVE-2025-65637 - Bugzilla
ENISA EUVD
Assigner mitre
Published Dec 4, 2025
Updated Dec 5, 2025
Exploited since n/a
Link EUVD-2025-201258
EUVD-2025-201258 GHSA-4F99-4Q7P-P3GH