A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without...
Original description
The description as published by the source.
A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- BellSoft Alpaquita BELL-CVE-2025-65637 skopeo Fixed in: 1.11.5-r0
- Debian DEBIAN-CVE-2025-65637 golang-logrus
- Ubuntu UBUNTU-CVE-2025-65637 golang-logrus
References
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- patch github.com
- report github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web security.snyk.io