NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐹
🐹 Go
Not in CISA KEV
HIGH severity

CVE-2025-65637 — logrus

HIGHFix: sirupsen/logrus#1376

CVE-2025-65637 is a high-severity (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in github.com/sirupsen/logrus. A fix is available for github.com/sirupsen/logrus — see the affected versions and patch details below.

Logrus is vulnerable to DoS when using Entry.Writer()

Also known asGHSA-4f99-4q7p-p3ghGO-2025-4188
Published
Updated
Affected
3 pkgs
Patched
3 / 3
Exploits
None indexed
Exploitation data as of Nov 4, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2025-65637.

EPSS Exploitation Probability

via FIRST.org ↗
0.7%probability of exploitation in next 30 days
Lower Risk+0.04%
Lower risk than most CVEs52th percentile — riskier than 52% of all scored CVEsHighest risk
0.00%0.39%0.78%1.18%0.0%0.7%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

3 pkgs affected
🐹github.com/sirupsen/logrus🐹github.com/sirupsen/logrus🐹github.com/sirupsen/logrus

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.

Affected Packages

3 total 3 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/sirupsen/logrusall versions1.8.3go get github.com/sirupsen/logrus@v1.8.3
🐹Gogithub.com/sirupsen/logrus≥ 1.9.0&&< 1.9.11.9.1go get github.com/sirupsen/logrus@v1.9.1
🐹Gogithub.com/sirupsen/logrus≥ 1.9.2&&< 1.9.31.9.3go get github.com/sirupsen/logrus@v1.9.3

Affected Products

1 product · 3 configurations
Application
logrusturbopuffer
< 1.8.3
2 versions
1.9.01.9.2

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/sirupsen/logrus, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update github.com/sirupsen/logrus to 1.8.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-65637 is resolved across your whole dependency graph.

  3. Workarounds

    Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatModerate

This vulnerability is categorized as Moderate because its impact is limited to the logging subsystem and requires a specific, non-default usage pattern to trigger—namely, sending a single unbounded line exceeding 64KB through Entry.Writer(). Most Logrus deployments do not expose this interface directly to…

Workaround published by Red Hat
Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.
Source: Red Hat security advisory for CVE-2025-65637 (CC BY 4.0)
ProductFixed inAdvisory
Red Hat Enterprise Linux 8container-tools:rhel8-8100020260204142227.afee755dRHSA-2026:3428
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportcontainer-tools:rhel8-8060020260422144418.ad008a3aRHSA-2026:10703
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportosbuild-composer-0:46.3-5.el8_6RHSA-2026:2687
Red Hat Enterprise Linux 8.8 Telecommunications Update Serviceosbuild-composer-0:75-6.el8_8RHSA-2026:2685
Red Hat Enterprise Linux 8.8 Telecommunications Update Servicecontainer-tools:rhel8-8080020260226135022.63b34585RHSA-2026:4693
Red Hat Enterprise Linux 8.8 Telecommunications Update Servicecontainer-tools:rhel8-8080020260325222945.63b34585RHSA-2026:6191
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutionsoci-seccomp-bpf-hook-0:1.2.10-1.el9_0RHSA-2026:15940
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutionsskopeo-2:1.8.0-4.1.el9_0.3RHSA-2026:15941

Frequently Asked Questions

A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.
O3 Security · Impact-Aware SCA

Is CVE-2025-65637 in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2025-65637: logrus DoS — Fixed in 1.8.3