Executive Summary

This vulnerability is a denial-of-service (DoS) issue in the github.com/sirupsen/logrus logging library. It occurs when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read operation fails with a "token too long" error, causing the writer pipe to close. This makes Writer() unusable and results in application unavailability.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause your application to become unavailable because the logging function Writer() stops working after encountering a large single-line payload without newlines. This denial-of-service condition can disrupt normal application operations that rely on logging, potentially leading to downtime or degraded service.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the github.com/sirupsen/logrus library to version 1.8.3, 1.9.1, 1.9.3 or later, where the issue is fixed by chunking input and maintaining writer functionality even if an error occurs.

Useful 0 Not Useful 0