Skip to main content

Uncontrolled Resource Consumption

CVE-2025-65637

High
7.5/10

Summary

A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using "Entry.Writer()" to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving "Writer()" unusable and causing application unavailability (DoS). This affects versions prior to 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3 and later, where the input is chunked and the writer continues to function even if an error is logged.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-400 - Uncontrolled resource consumption

An uncontrolled resource allocation attack (also known as resource exhaustion attack) triggers unauthorized overconsumption of the limited resources in an application, such as memory, file system storage, database connection pool entries, and CPU. This may lead to denial of service for valid users and degradation of the application's functionality as well as that of the host operating system.

References

Advisory Timeline

  • Published