A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.
History

Tue, 16 Dec 2025 00:15:00 +0000

Type Values Removed Values Added
Title github.com/sirupsen/logrus: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload
References
Metrics threat_severity

None

threat_severity

Moderate


Fri, 05 Dec 2025 22:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Fri, 05 Dec 2025 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Logrus Project
Logrus Project logrus
Vendors & Products Logrus Project
Logrus Project logrus

Thu, 04 Dec 2025 18:30:00 +0000

Type Values Removed Values Added
Description A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.
References

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2025-12-05T21:52:59.784Z

Reserved: 2025-11-18T00:00:00.000Z

Link: CVE-2025-65637

cve-icon Vulnrichment

Updated: 2025-12-05T21:52:53.941Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-12-04T19:16:05.223

Modified: 2025-12-08T18:27:15.857

Link: CVE-2025-65637

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-12-04T00:00:00Z

Links: CVE-2025-65637 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2025-12-05T10:52:08Z