CVE-2025-65637

github.com/sirupsen/logrus: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload

Published Dec 4, 2025 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Description
A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-4f99-4q7p-p3gh Logrus is vulnerable to DoS when using Entry.Writer()
History
Type Values Removed Values Added
First Time appeared Turbopuffer
Turbopuffer logrus
CPEs cpe:2.3:a:turbopuffer:logrus:*:*:*:*:*:go:*:*
cpe:2.3:a:turbopuffer:logrus:1.9.0:*:*:*:*:go:*:*
cpe:2.3:a:turbopuffer:logrus:1.9.2:*:*:*:*:go:*:*
Vendors & Products Turbopuffer
Turbopuffer logrus
Type Values Removed Values Added
Title github.com/sirupsen/logrus: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload
References
Metrics threat_severity

None

threat_severity

Moderate

Type Values Removed Values Added
Weaknesses CWE-400
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
First Time appeared Logrus Project
Logrus Project logrus
Vendors & Products Logrus Project
Logrus Project logrus
Type Values Removed Values Added
Description A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Dec 5, 2025, 9:52 PM
Reserved
Nov 18, 2025, 12:00 AM
Status
Analyzed
Published
Dec 4, 2025, 7:16 PM
Modified
Nov 4, 2026, 10:10 PM
Severity
Moderate
Public date
Dec 4, 2025, 12:00 AM