BaseFortify

Publication date: 2025-12-04

Last updated on: 2025-12-08

Assigner: MITRE

Description

A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-04

Last Modified

2025-12-08

Generated

2026-07-06

AI Q&A

2025-12-04

EPSS Evaluated

2026-07-05

NVD

CVE-2025-65637

Affected Vendors & Products

Vendor	Product	Version / Range
sirupsen	logrus	1.9.3
sirupsen	logrus	1.9.2
sirupsen	logrus	1.9.1
sirupsen	logrus	1.8.1
sirupsen	logrus	1.9.0
sirupsen	logrus	1.8.3
sirupsen	logrus	1.8.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial-of-service (DoS) issue in the github.com/sirupsen/logrus logging library. It occurs when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read operation fails with a "token too long" error, causing the writer pipe to close. This makes Writer() unusable and results in application unavailability.

Impact Analysis

The vulnerability can cause your application to become unavailable because the logging function Writer() stops working after encountering a large single-line payload without newlines. This denial-of-service condition can disrupt normal application operations that rely on logging, potentially leading to downtime or degraded service.

Mitigation Strategies

To mitigate this vulnerability, upgrade the github.com/sirupsen/logrus library to version 1.8.3, 1.9.1, 1.9.3 or later, where the issue is fixed by chunking input and maintaining writer functionality even if an error occurs.

Hi! I’m here to help you understand CVE-2025-65637. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70