A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- BellSoft Alpaquita BELL-CVE-2025-65637 skopeo Corrigé dans: 1.11.5-r0
- Debian DEBIAN-CVE-2025-65637 golang-logrus
- Ubuntu UBUNTU-CVE-2025-65637 golang-logrus
Références
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- patch github.com
- report github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web security.snyk.io