N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-65637

CVE-2025-65637: Logrus is vulnerable to DoS when using Entry.Writer()

A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-65637

CVE-2025-65637:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/sirupsen/logrus	go	< 1.8.3	1.8.3
github.com/sirupsen/logrus	go	= 1.9.0	1.9.1
github.com/sirupsen/logrus	go	= 1.9.2	1.9.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the way github.com/sirupsen/logrus handles logging from an io.Writer interface, specifically when using Entry.Writer() or Entry.WriterLevel(). These functions create a pipe and spawn a goroutine running the Entry.writerScanner function to read from the pipe.

The root cause of the vulnerability is in the Entry.writerScanner function. Prior to the patch, it used a standard bufio.Scanner to read log lines. The default bufio.Scanner has a maximum line length (token size) of 64KB. If an application wrote a single line of data exceeding this limit to the writer, the scanner would fail with a bufio.ErrTooLong error. The error handling in place would then close the pipe, rendering the writer permanently unusable for any further logging. This would cause the application to hang or crash if it continued to try logging, resulting in a Denial of Service (DoS).

The patch addresses this by modifying Entry.writerScanner to handle large inputs. It implements a custom split function for the bufio.Scanner that chunks the input data into 64KB segments. This prevents the 'token too long' error, allowing the logger to process arbitrarily long single-line payloads by breaking them down into manageable pieces. The vulnerable functions are Entry.Writer and Entry.WriterLevel, which initiate the process, and Entry.writerScanner, which contains the flawed scanning logic.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.