CVE-2025-65637
High · 7.5Logrus is vulnerable to DoS when using Entry.Writer()
CVSS
7.5
EPSS
0.6%
Published
Dec 4, 2025
CISA due date
—
The record
A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/sirupsen/logrus | 0 | 1.8.3 |
| Go | github.com/sirupsen/logrus | 1.9.0 | 1.9.1 |
| Go | github.com/sirupsen/logrus | 1.9.2 | 1.9.3 |
| Chainguard | aws-flb-cloudwatch | 0 | 1.9.4-r22 |
| Chainguard | aws-flb-cloudwatch-compat | 0 | 1.9.4-r22 |
| Chainguard | aws-flb-cloudwatch-compat-fips | 0 | 1.9.4-r16 |
| Chainguard | aws-flb-cloudwatch-fips | 0 | 1.9.4-r16 |
| Chainguard | aws-flb-firehose | 0 | 1.7.2-r22 |
| Chainguard | aws-flb-firehose-compat | 0 | 1.7.2-r22 |
| Chainguard | aws-flb-firehose-compat-fips | 0 | 1.7.2-r16 |
| Chainguard | aws-flb-firehose-fips | 0 | 1.7.2-r16 |
| Chainguard | aws-flb-kinesis | 0 | 1.10.3-r3 |
| Chainguard | aws-flb-kinesis-compat | 0 | 1.10.3-r3 |
| Chainguard | aws-flb-kinesis-compat-fips | 0 | 1.10.3-r4 |
| Chainguard | aws-flb-kinesis-fips | 0 | 1.10.3-r4 |
| Chainguard | consul-1.18 | 0 | 1.18.2-r47 |
| Chainguard | consul-1.18-oci-entrypoint | 0 | 1.18.2-r47 |
| Chainguard | consul-1.18-oci-entrypoint-compat | 0 | 1.18.2-r47 |
| Chainguard | consul-1.19 | 0 | 1.19.2-r46 |
| Chainguard | consul-1.19-oci-entrypoint | 0 | 1.19.2-r46 |
| Chainguard | consul-1.19-oci-entrypoint-compat | 0 | 1.19.2-r46 |
| Chainguard | consul-1.20 | 0 | 1.20.6-r10 |
| Chainguard | consul-1.20-oci-entrypoint | 0 | 1.20.6-r10 |
| Chainguard | consul-1.20-oci-entrypoint-compat | 0 | 1.20.6-r10 |
| Chainguard | consul-1.21 | 0 | 1.21.5-r5 |
| Chainguard | consul-1.21-oci-entrypoint | 0 | 1.21.5-r5 |
| Chainguard | consul-1.21-oci-entrypoint-compat | 0 | 1.21.5-r5 |
| Chainguard | consul-fips-1.19 | 0 | 1.19.2-r45 |
| Chainguard | consul-fips-1.19-oci-entrypoint | 0 | 1.19.2-r45 |
| Chainguard | consul-fips-1.19-oci-entrypoint-compat | 0 | 1.19.2-r45 |
| Chainguard | consul-fips-1.20 | 0 | 1.20.6-r9 |
| Chainguard | consul-fips-1.20-oci-entrypoint | 0 | 1.20.6-r9 |
| Chainguard | consul-fips-1.20-oci-entrypoint-compat | 0 | 1.20.6-r9 |
| Chainguard | consul-fips-1.21 | 0 | 1.21.5-r5 |
| Chainguard | consul-fips-1.21-oci-entrypoint | 0 | 1.21.5-r5 |
| Chainguard | consul-fips-1.21-oci-entrypoint-compat | 0 | 1.21.5-r5 |
| Chainguard | docker-credential-gcr | 0 | 2.1.30-r7 |
| Chainguard | docker-credential-gcr-fips | 0 | 2.1.30-r6 |
| Chainguard | falcoctl-fips-0.4 | 0 | 0.4.0-r28 |
| Chainguard | go-discover | 0 | 0_git20251216-r0 |
| Chainguard | go-discover-fips | 0 | 0_git20251208-r1 |
| Chainguard | gostatsd | 0 | 28.3.0-r21 |
| Chainguard | hello-world-golang | 0 | 1.3-r16 |
| Chainguard | kiam | 0 | 4.2-r32 |
| Chainguard | kiam-compat | 0 | 4.2-r32 |
| Chainguard | kpt | 0 | 1.0.0_beta55-r15 |
| Chainguard | kube-fluentd-operator | 0 | 1.18.2-r53 |
| Chainguard | kube-fluentd-operator-compat | 0 | 1.18.2-r53 |
| Chainguard | kube-fluentd-operator-default-config | 0 | 1.18.2-r53 |
| Chainguard | kube-fluentd-operator-oci-entrypoint | 0 | 1.18.2-r53 |
| Chainguard | kubeflow-access-management | 0 | 1.10.0-r10 |
| Chainguard | kubeflow-access-management-fips | 0 | 1.10.0-r10 |
| Chainguard | kubeflow-profile-controller | 0 | 1.10.0-r10 |
| Chainguard | kubeflow-profile-controller-fips | 0 | 1.10.0-r10 |
| Chainguard | kubernetes-event-exporter-fips | 0 | 1.7-r17 |
| Chainguard | neuvector-db-updater | 0 | 0_git20240423-r10 |
| Chainguard | neuvector-db-updater-fips | 0 | 0_git20240423-r11 |
| Chainguard | neuvector-dbgen | 0 | 0_git20240423-r10 |
| Chainguard | neuvector-dbgen-fips | 0 | 0_git20240423-r11 |
| Chainguard | newrelic-nri-statsd | 0 | 2.12.0-r2 |
| Chainguard | php-fpm_exporter | 0 | 2.2.0-r19 |
| Chainguard | prometheus-beat-exporter | 0 | 0.4.0-r18 |
| Chainguard | prometheus-beat-exporter-fips | 0 | 0.4.0-r20 |
| Chainguard | prometheus-mongodb-exporter-0.37 | 0 | 0.37.0-r27 |
| Chainguard | prometheus-mongodb-exporter-fips-0.37 | 0 | 0.37.0-r32 |
| Chainguard | smokescreen | 0 | 0_git20251203-r1 |
| Chainguard | smokescreen-compat | 0 | 0_git20251203-r1 |
| Chainguard | sonobuoy | 0 | 0.57.3-r12 |
| Chainguard | sonobuoy-compat | 0 | 0.57.3-r12 |
| Chainguard | sonobuoy-fips | 0 | 0.57.3-r5 |
| Chainguard | src-fingerprint | 0 | 0.19.0-r36 |
| Chainguard | src-fingerprint-fips | 0 | 0.19.0-r22 |
| Chainguard | stakater-reloader-0.0.119 | 0 | 0.0.119-r27 |
| Chainguard | stakater-reloader-0.0.128 | 0 | 0.0.128-r26 |
| Chainguard | stakater-reloader-compat-0.0.119 | 0 | 0.0.119-r27 |
| Chainguard | stakater-reloader-compat-0.0.128 | 0 | 0.0.128-r26 |
| Chainguard | terraform-provider-google | 0 | 7.12.0-r3 |
| Chainguard | terraform-provider-google-fips | 0 | 7.12.0-r3 |
| Chainguard | wavefront-collector-for-kubernetes-1.12 | 0 | 1.12.1-r33 |
| Chainguard | wavefront-collector-for-kubernetes-1.13 | 0 | 1.13.0-r33 |
| Wolfi | aws-flb-cloudwatch | 0 | 1.9.4-r22 |
| Wolfi | aws-flb-cloudwatch-compat | 0 | 1.9.4-r22 |
| Wolfi | aws-flb-firehose | 0 | 1.7.2-r22 |
| Wolfi | aws-flb-firehose-compat | 0 | 1.7.2-r22 |
| Wolfi | aws-flb-kinesis | 0 | 1.10.3-r3 |
| Wolfi | aws-flb-kinesis-compat | 0 | 1.10.3-r3 |
| Wolfi | docker-credential-gcr | 0 | 2.1.30-r7 |
| Wolfi | go-discover | 0 | 0_git20251216-r0 |
| Wolfi | gostatsd | 0 | 28.3.0-r21 |
| Wolfi | hello-world-golang | 0 | 1.3-r16 |
| Wolfi | kpt | 0 | 1.0.0_beta55-r15 |
| Wolfi | kube-fluentd-operator | 0 | 1.18.2-r53 |
| Wolfi | kube-fluentd-operator-compat | 0 | 1.18.2-r53 |
| Wolfi | kube-fluentd-operator-default-config | 0 | 1.18.2-r53 |
| Wolfi | kube-fluentd-operator-oci-entrypoint | 0 | 1.18.2-r53 |
| Wolfi | kubeflow-access-management | 0 | 1.10.0-r10 |
| Wolfi | kubeflow-profile-controller | 0 | 1.10.0-r10 |
| Wolfi | neuvector-db-updater | 0 | 0_git20240423-r10 |
| Wolfi | neuvector-dbgen | 0 | 0_git20240423-r10 |
| Wolfi | newrelic-nri-statsd | 0 | 2.12.0-r2 |
| Wolfi | php-fpm_exporter | 0 | 2.2.0-r19 |
| Wolfi | prometheus-beat-exporter | 0 | 0.4.0-r18 |
| Wolfi | smokescreen | 0 | 0_git20251203-r1 |
| Wolfi | smokescreen-compat | 0 | 0_git20251203-r1 |
| Wolfi | sonobuoy | 0 | 0.57.3-r12 |
| Wolfi | sonobuoy-compat | 0 | 0.57.3-r12 |
| Wolfi | src-fingerprint | 0 | 0.19.0-r36 |
| Wolfi | terraform-provider-google | 0 | 7.12.0-r3 |
| go | github.com/sirupsen/logrus | 1.9.0 | No fix |
| go | github.com/sirupsen/logrus | 1.9.0 | 1.9.1 |
| go | github.com/sirupsen/logrus | 1.9.2 | No fix |
| go | github.com/sirupsen/logrus | 1.9.2 | 1.9.3 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20251230T014957-150000.1.134.1 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260123T022811-150000.1.140.1 |
Related vulnerabilities
- CVE-2025-68121 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or… Also affects aws-flb-cloudwatch
- CVE-2025-61732 A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling… Also affects aws-flb-cloudwatch
- CVE-2025-68119 Downloading and building modules with malicious version strings can cause local code… Also affects aws-flb-cloudwatch
- CVE-2025-61731 Building a malicious file with cmd/go can cause can cause a write to an… Also affects aws-flb-cloudwatch
- CVE-2025-61726 The net/url package does not set a limit on the number of query parameters in a query. Also affects aws-flb-cloudwatch
- CVE-2025-61728 archive/zip uses a super-linear file name indexing algorithm that is invoked the first… Also affects aws-flb-cloudwatch
- CVE-2025-61730 During the TLS 1.3 handshake if multiple messages are sent in records that span… Also affects aws-flb-cloudwatch
- CVE-2025-61729 Within HostnameError.Error(), when constructing an error string, there is no limit to the… Also affects aws-flb-cloudwatch