CVE-2025-65637: turbopuffer logrus Uncontrolled Resource Consumption

Analyzed

AliasesRHSA-2026:11804RHSA-2026:12273RHSA-2026:13971+170 more

Published 04-12-2025Last modified 05-12-2025

Vulnerability summary

CVE-2025-65637 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in turbopuffer logrus. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 50.2% of scored vulnerabilities. 3 public exploits are recorded.

Priority

Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.63%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits3github, reference

Timeline

04-12-2025
PublishedVulnerability first disclosed.
05-12-2025
Last modifiedVulnerability information updated.

Description

A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.

CVSS metrics

8 scores · 8 sources · 2 versions

v4.08.7v3.17.5

EPSS trend

Probability

0.63%

Chance of exploitation in the next 30 days

Percentile

50%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.63% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

3 found

githubUnverified
Logrus Dos Poc
Maturity: poc
githubUnverified
Logrus
Maturity: poc
referenceUnverified
Exploit Reference (security.snyk.io)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard77 products

aws-flb-cloudwatch< 1.9.4-r22
aws-flb-cloudwatch-compat< 1.9.4-r22
aws-flb-cloudwatch-compat-fips< 1.9.4-r16
aws-flb-cloudwatch-fips< 1.9.4-r16
aws-flb-firehose< 1.7.2-r22

aws-flb-firehose-compat< 1.7.2-r22
aws-flb-firehose-compat-fips< 1.7.2-r16
aws-flb-firehose-fips< 1.7.2-r16
aws-flb-kinesis< 1.10.3-r3
aws-flb-kinesis-compat< 1.10.3-r3
aws-flb-kinesis-compat-fips< 1.10.3-r4
aws-flb-kinesis-fips< 1.10.3-r4
consul-1.18< 1.18.2-r47
consul-1.18-oci-entrypoint< 1.18.2-r47
consul-1.18-oci-entrypoint-compat< 1.18.2-r47
consul-1.19< 1.19.2-r46
consul-1.19-oci-entrypoint< 1.19.2-r46
consul-1.19-oci-entrypoint-compat< 1.19.2-r46
consul-1.20< 1.20.6-r10
consul-1.20-oci-entrypoint< 1.20.6-r10
consul-1.20-oci-entrypoint-compat< 1.20.6-r10
consul-1.21< 1.21.5-r5
consul-1.21-oci-entrypoint< 1.21.5-r5
consul-1.21-oci-entrypoint-compat< 1.21.5-r5
consul-fips-1.19< 1.19.2-r45
consul-fips-1.19-oci-entrypoint< 1.19.2-r45
consul-fips-1.19-oci-entrypoint-compat< 1.19.2-r45
consul-fips-1.20< 1.20.6-r9
consul-fips-1.20-oci-entrypoint< 1.20.6-r9
consul-fips-1.20-oci-entrypoint-compat< 1.20.6-r9
consul-fips-1.21< 1.21.5-r5
consul-fips-1.21-oci-entrypoint< 1.21.5-r5
consul-fips-1.21-oci-entrypoint-compat< 1.21.5-r5
docker-credential-gcr< 2.1.30-r7
docker-credential-gcr-fips< 2.1.30-r6
falcoctl-fips-0.4< 0.4.0-r28
go-discover< 0_git20251216-r0
go-discover-fips< 0_git20251208-r1
gostatsd< 28.3.0-r21
hello-world-golang< 1.3-r16
kiam< 4.2-r32
kiam-compat< 4.2-r32
kpt< 1.0.0_beta55-r15
kube-fluentd-operator< 1.18.2-r53
kube-fluentd-operator-compat< 1.18.2-r53
kube-fluentd-operator-default-config< 1.18.2-r53
kube-fluentd-operator-oci-entrypoint< 1.18.2-r53
kubeflow-access-management< 1.10.0-r10
kubeflow-access-management-fips< 1.10.0-r10
kubeflow-profile-controller< 1.10.0-r10
kubeflow-profile-controller-fips< 1.10.0-r10
kubernetes-event-exporter-fips< 1.7-r17
neuvector-db-updater< 0_git20240423-r10
neuvector-db-updater-fips< 0_git20240423-r11
neuvector-dbgen< 0_git20240423-r10
neuvector-dbgen-fips< 0_git20240423-r11
newrelic-nri-statsd< 2.12.0-r2
php-fpm_exporter< 2.2.0-r19
prometheus-beat-exporter< 0.4.0-r18
prometheus-beat-exporter-fips< 0.4.0-r20
prometheus-mongodb-exporter-0.37< 0.37.0-r27
prometheus-mongodb-exporter-fips-0.37< 0.37.0-r32
smokescreen< 0_git20251203-r1
smokescreen-compat< 0_git20251203-r1
sonobuoy< 0.57.3-r12
sonobuoy-compat< 0.57.3-r12
sonobuoy-fips< 0.57.3-r5
src-fingerprint< 0.19.0-r36
src-fingerprint-fips< 0.19.0-r22
stakater-reloader-0.0.119< 0.0.119-r27
stakater-reloader-0.0.128< 0.0.128-r26
stakater-reloader-compat-0.0.119< 0.0.119-r27
stakater-reloader-compat-0.0.128< 0.0.128-r26
terraform-provider-google< 7.12.0-r3
terraform-provider-google-fips< 7.12.0-r3
wavefront-collector-for-kubernetes-1.12< 1.12.1-r33
wavefront-collector-for-kubernetes-1.13< 1.13.0-r33

Show all 77

Redhat36 products

microshift< 0:4.17.49-202602161401.p0.g708a69a.assembly.4.17.49.el9 | < 0:4.16.58-202603160404.p0.gb9661ec.assembly.4.16.58.el9
microshift-greenboot< 0:4.17.49-202602161401.p0.g708a69a.assembly.4.17.49.el9 | < 0:4.16.58-202603160404.p0.gb9661ec.assembly.4.16.58.el9
microshift-low-latency< 0:4.17.49-202602161401.p0.g708a69a.assembly.4.17.49.el9
microshift-multus< 0:4.17.49-202602161401.p0.g708a69a.assembly.4.17.49.el9 | < 0:4.16.58-202603160404.p0.gb9661ec.assembly.4.16.58.el9
microshift-multus-release-info< 0:4.17.49-202602161401.p0.g708a69a.assembly.4.17.49.el9 | < 0:4.16.58-202603160404.p0.gb9661ec.assembly.4.16.58.el9

microshift-networking< 0:4.17.49-202602161401.p0.g708a69a.assembly.4.17.49.el9 | < 0:4.16.58-202603160404.p0.gb9661ec.assembly.4.16.58.el9
microshift-olm< 0:4.17.49-202602161401.p0.g708a69a.assembly.4.17.49.el9 | < 0:4.16.58-202603160404.p0.gb9661ec.assembly.4.16.58.el9
microshift-olm-release-info< 0:4.17.49-202602161401.p0.g708a69a.assembly.4.17.49.el9 | < 0:4.16.58-202603160404.p0.gb9661ec.assembly.4.16.58.el9
microshift-release-info< 0:4.17.49-202602161401.p0.g708a69a.assembly.4.17.49.el9 | < 0:4.16.58-202603160404.p0.gb9661ec.assembly.4.16.58.el9
microshift-selinux< 0:4.17.49-202602161401.p0.g708a69a.assembly.4.17.49.el9 | < 0:4.16.58-202603160404.p0.gb9661ec.assembly.4.16.58.el9
oci-seccomp-bpf-hook< 0:1.2.10-1.el9_2 | < 0:1.2.10-1.el9_0
oci-seccomp-bpf-hook-debuginfo< 0:1.2.10-1.el9_2 | < 0:1.2.10-1.el9_0
oci-seccomp-bpf-hook-debugsource< 0:1.2.10-1.el9_2 | < 0:1.2.10-1.el9_0
openshift< 0:4.12.0-202604271501.p2.gedc7ba9.assembly.stream.el8 | < 0:4.12.0-202604271501.p2.gedc7ba9.assembly.stream.el9 | < 0:4.16.0-202602100409.p2.g41c4e9b.assembly.stream.el8 | < 0:4.16.0-202602100409.p2.g41c4e9b.assembly.stream.el9 | < 0:4.17.0-202602031716.p2.g4e295fa.assembly.stream.el8 | < 0:4.17.0-202602031716.p2.g4e295fa.assembly.stream.el9 | < 0:4.14.0-202602170118.p2.ga3faddd.assembly.stream.el8 | < 0:4.14.0-202602170118.p2.ga3faddd.assembly.stream.el9 | < 0:4.13.0-202603240119.p2.g7aa9360.assembly.stream.el8 | < 0:4.13.0-202603240119.p2.g7aa9360.assembly.stream.el9
openshift-hyperkube< 0:4.12.0-202604271501.p2.gedc7ba9.assembly.stream.el8 | < 0:4.12.0-202604271501.p2.gedc7ba9.assembly.stream.el9 | < 0:4.16.0-202602100409.p2.g41c4e9b.assembly.stream.el8 | < 0:4.16.0-202602100409.p2.g41c4e9b.assembly.stream.el9 | < 0:4.17.0-202602031716.p2.g4e295fa.assembly.stream.el8 | < 0:4.17.0-202602031716.p2.g4e295fa.assembly.stream.el9 | < 0:4.14.0-202602170118.p2.ga3faddd.assembly.stream.el8 | < 0:4.14.0-202602170118.p2.ga3faddd.assembly.stream.el9 | < 0:4.13.0-202603240119.p2.g7aa9360.assembly.stream.el8 | < 0:4.13.0-202603240119.p2.g7aa9360.assembly.stream.el9
openshift-kube-apiserver< 0:4.16.0-202602100409.p2.g41c4e9b.assembly.stream.el8 | < 0:4.16.0-202602100409.p2.g41c4e9b.assembly.stream.el9 | < 0:4.17.0-202602031716.p2.g4e295fa.assembly.stream.el8 | < 0:4.17.0-202602031716.p2.g4e295fa.assembly.stream.el9
openshift-kube-controller-manager< 0:4.16.0-202602100409.p2.g41c4e9b.assembly.stream.el8 | < 0:4.16.0-202602100409.p2.g41c4e9b.assembly.stream.el9 | < 0:4.17.0-202602031716.p2.g4e295fa.assembly.stream.el8 | < 0:4.17.0-202602031716.p2.g4e295fa.assembly.stream.el9
openshift-kube-scheduler< 0:4.16.0-202602100409.p2.g41c4e9b.assembly.stream.el8 | < 0:4.16.0-202602100409.p2.g41c4e9b.assembly.stream.el9 | < 0:4.17.0-202602031716.p2.g4e295fa.assembly.stream.el8 | < 0:4.17.0-202602031716.p2.g4e295fa.assembly.stream.el9
openshift-kubelet< 0:4.16.0-202602100409.p2.g41c4e9b.assembly.stream.el8 | < 0:4.16.0-202602100409.p2.g41c4e9b.assembly.stream.el9 | < 0:4.17.0-202602031716.p2.g4e295fa.assembly.stream.el8 | < 0:4.17.0-202602031716.p2.g4e295fa.assembly.stream.el9
osbuild-composer< 0:75-6.el8_8 | < 0:46.3-6.el9_0 | < 0:46.3-5.el8_6 | < 0:76.1-4.el9_2
osbuild-composer-core< 0:75-6.el8_8 | < 0:46.3-6.el9_0 | < 0:46.3-5.el8_6 | < 0:76.1-4.el9_2
osbuild-composer-core-debuginfo< 0:75-6.el8_8 | < 0:46.3-6.el9_0 | < 0:46.3-5.el8_6 | < 0:76.1-4.el9_2
osbuild-composer-debuginfo< 0:75-6.el8_8 | < 0:46.3-5.el8_6 | < 0:76.1-4.el9_2
osbuild-composer-debugsource< 0:75-6.el8_8 | < 0:46.3-6.el9_0 | < 0:46.3-5.el8_6 | < 0:76.1-4.el9_2
osbuild-composer-dnf-json< 0:75-6.el8_8 | < 0:46.3-6.el9_0 | < 0:46.3-5.el8_6 | < 0:76.1-4.el9_2
osbuild-composer-tests-debuginfo< 0:75-6.el8_8 | < 0:46.3-6.el9_0 | < 0:46.3-5.el8_6 | < 0:76.1-4.el9_2
osbuild-composer-worker< 0:75-6.el8_8 | < 0:46.3-6.el9_0 | < 0:46.3-5.el8_6 | < 0:76.1-4.el9_2
osbuild-composer-worker-debuginfo< 0:75-6.el8_8 | < 0:46.3-6.el9_0 | < 0:46.3-5.el8_6 | < 0:76.1-4.el9_2
skopeo< 2:1.11.4-0.1.el9_2.5 | < 2:1.8.0-4.1.el9_0.3
skopeo-debuginfo< 2:1.11.4-0.1.el9_2.5 | < 2:1.8.0-4.1.el9_0.3
skopeo-debugsource< 2:1.11.4-0.1.el9_2.5 | < 2:1.8.0-4.1.el9_0.3
skopeo-tests< 2:1.11.4-0.1.el9_2.5 | < 2:1.8.0-4.1.el9_0.3
toolbox< 0:0.0.99.4.1-1.el9_2 | < 0:0.0.99.5.1-2.el9_4
toolbox-debuginfo< 0:0.0.99.4.1-1.el9_2 | < 0:0.0.99.5.1-2.el9_4
toolbox-debugsource< 0:0.0.99.4.1-1.el9_2 | < 0:0.0.99.5.1-2.el9_4
toolbox-tests< 0:0.0.99.4.1-1.el9_2 | < 0:0.0.99.5.1-2.el9_4

Show all 36

Wolfi27 products

aws-flb-cloudwatch< 1.9.4-r22
aws-flb-cloudwatch-compat< 1.9.4-r22
aws-flb-firehose< 1.7.2-r22
aws-flb-firehose-compat< 1.7.2-r22
aws-flb-kinesis< 1.10.3-r3

Show all 27

Debian1 product

golang-logrusAll versions (No fix recorded) | < 1.9.3-1

Github.com/sirupsen1 product

logrus< 1.8.3 | ≥ 1.9.0, < 1.9.1 | ≥ 1.9.2, < 1.9.3

Turbopuffer1 product

logrus< 1.8.3 | 1.9.0 | 1.9.2

Ubuntu1 product

golang-logrusAll versions (No fix recorded)

7 vendors · 144 products

References

54 links

github.com/mjuanxd/logrus-dos-pocARTICLEREPORTPACKAGEWEBExploitThird Party Advisory
github.com/sirupsen/logrus/issues/1370ARTICLEREPORTWEBExploitIssue TrackingPatch
github.com/sirupsen/logrus/pull/1376ARTICLEREPORTFIXWEBIssue TrackingPatch
github.com/sirupsen/logrus/releases/tag/v1.8.3ARTICLEREPORTWEBRelease Notes
github.com/sirupsen/logrus/releases/tag/v1.9.1ARTICLEREPORTWEBRelease Notes
github.com/sirupsen/logrus/releases/tag/v1.9.3ARTICLEREPORTWEBRelease Notes
security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSIRUPSENLOGRUS-5564391ARTICLEREPORTWEBExploitThird Party Advisory
github.com/mjuanxd/logrus-dos-poc/blob/main/README.mdARTICLEREPORTWEBExploitThird Party Advisory
access.redhat.com/errata/RHSA-2026:11804Advisory
access.redhat.com/security/updates/classification/ARTICLE

Show all 54 references