A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- BellSoft Alpaquita BELL-CVE-2025-65637 skopeo 修正版: 1.11.5-r0
- Debian DEBIAN-CVE-2025-65637 golang-logrus
- Ubuntu UBUNTU-CVE-2025-65637 golang-logrus
参照URL
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- patch github.com
- report github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web security.snyk.io