github.com/sirupsen/logrus: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | n/a | affected |
|
Configuration 1 [-]
|
No data.
| Vendor | Product | Versions |
|---|---|---|
| Logrus Project | Logrus | — |
| Source | ID | Title |
|---|---|---|
Github GHSA |
GHSA-4f99-4q7p-p3gh | Logrus is vulnerable to DoS when using Entry.Writer() |
No CVSS v4.0
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.675% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Turbopuffer
Turbopuffer logrus |
|
| CPEs | cpe:2.3:a:turbopuffer:logrus:*:*:*:*:*:go:*:* cpe:2.3:a:turbopuffer:logrus:1.9.0:*:*:*:*:go:*:* cpe:2.3:a:turbopuffer:logrus:1.9.2:*:*:*:*:go:*:* |
|
| Vendors & Products |
Turbopuffer
Turbopuffer logrus |
| Type | Values Removed | Values Added |
|---|---|---|
| Title | github.com/sirupsen/logrus: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload | |
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-400 | |
| Metrics |
cvssV3_1
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Logrus Project
Logrus Project logrus |
|
| Vendors & Products |
Logrus Project
Logrus Project logrus |
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged. | |
| References |
|
|
View source · Bugzilla · JSON
OpenCVE enrichment
Updated: Dec 5, 2025, 10:52 AM
Github GHSA