CVE-2025-65637

216.73.217.17

· Published 04/12/2025 19:16 · Modified 23/12/2025 00:26

Labels: CVE-2025-65637 2025-12-04 CVE-2025-65637 CWE-400 [email protected]

Essential information

Published: 04/12/2025 19:16
Modified: 23/12/2025 00:26
Author: —
Creator: —
CVSS: 7.5 HIGH (v3.1)
CISA KEV: No
CWE: —
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS metrics

Description

A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.

NVD status

Status: Analyzed — CVE has had analysis completed and all data associations made.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
turbopuffer / logrus	`cpe:2.3:a:turbopuffer:logrus::::::go::*`
turbopuffer / logrus	`cpe:2.3:a:turbopuffer:logrus:1.9.0:::::go::`
turbopuffer / logrus	`cpe:2.3:a:turbopuffer:logrus:1.9.2:::::go::`