{"cve":"CVE-2025-65637","nvd":{"published":"2025-12-04T19:16:05.223","modified":"2026-06-17T09:55:50.633","status":"Analyzed","description":"A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with \"token too long\" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-400"],"references":["https://github.com/mjuanxd/logrus-dos-poc","https://github.com/mjuanxd/logrus-dos-poc/blob/main/README.md","https://github.com/sirupsen/logrus/issues/1370","https://github.com/sirupsen/logrus/pull/1376","https://github.com/sirupsen/logrus/releases/tag/v1.8.3"],"products":["turbopuffer:logrus"],"source":"nvd","synced_at":"2026-10-19T22:16:40.427100871+00:00"},"epss":{"cve":"CVE-2025-65637","score":0.0063,"percentile":0.50184,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-4f99-4q7p-p3gh","url":"https://osv.dev/vulnerability/GHSA-4f99-4q7p-p3gh","summary":"Logrus is vulnerable to DoS when using Entry.Writer()","modified":"2026-09-10T03:50:31.284939045Z","packages":[{"ecosystem":"Go","name":"github.com/sirupsen/logrus","purl":"pkg:golang/github.com/sirupsen/logrus","ranges":["<1.8.3"],"fixed":["1.8.3"]},{"ecosystem":"Go","name":"github.com/sirupsen/logrus","purl":"pkg:golang/github.com/sirupsen/logrus","ranges":[">=1.9.0 <1.9.1"],"fixed":["1.9.1"]},{"ecosystem":"Go","name":"github.com/sirupsen/logrus","purl":"pkg:golang/github.com/sirupsen/logrus","ranges":[">=1.9.2 <1.9.3"],"fixed":["1.9.3"]}]},{"id":"GO-2025-4188","url":"https://osv.dev/vulnerability/GO-2025-4188","summary":"Logrus is vulnerable to DoS when using Entry.writerScanner in github.com/sirupsen/logrus","modified":"2026-02-04T04:00:09.677829Z","packages":[{"ecosystem":"Go","name":"github.com/sirupsen/logrus","purl":"pkg:golang/github.com/sirupsen/logrus","ranges":["<1.8.3",">=1.9.0 <1.9.1",">=1.9.2 <1.9.3"],"fixed":["1.8.3","1.9.1","1.9.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}