CVE-2025-65637High▾ MidnightPoC availableLogrus is vulnerable to DoS when using Entry.Writer()
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.6%
1 GitHub repo (last check)
A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.
github.com/sirupsen/logrus < 1.8.3github.com/sirupsen/logrus >= 1.9.0, < 1.9.1github.com/sirupsen/logrus >= 1.9.2, < 1.9.3Upgrade to a patched release:
github.com/sirupsen/logrus 1.8.3github.com/sirupsen/logrus 1.9.1github.com/sirupsen/logrus 1.9.3