Vulnerabilities in pkg:golang/github.com/sirupsen/logrus
PACKAGECVE-2025-65637 is a HIGH denial of service vulnerability (CWE-400: Uncontrolled Resource Consumption) affecting Github.com/sirupsen/logrus libraries in the Go ecosystem. The issue involves logrus is vulnerable to dos when using entry.writer(). Remediation is available by upgrading affected packages to version 1.8.3, 1.9.1, 1.9.3.
pkg:golang/github.com/sirupsen/logrus
Vulnerability advisories affecting package pkg:golang/github.com/sirupsen/logrus. Select an advisory below to view technical details or fixes.
| Advisory ID | CVE / NVD | Severity | Summary |
|---|---|---|---|
| GHSA-4f99-4q7p-p3gh | CVE-2025-65637 | HIGH | Logrus is vulnerable to DoS when using Entry.Writer() |
CVE-2025-65637 at a Glance
How to Fix CVE-2025-65637
To remediate this vulnerability, upgrade all affected Github.com/sirupsen/logrus dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/sirupsen/logrus to 1.8.3Upgrade github.com/sirupsen/logrus to 1.9.1Upgrade github.com/sirupsen/logrus to 1.9.3Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/sirupsen/logrusHow to Check if You Are Affected
To determine whether your application is affected by CVE-2025-65637, inspect your project dependencies for Github.com/sirupsen/logrus:
inspect dependencies for github.com/sirupsen/logrusAnalyze the terminal output to locate any version of Github.com/sirupsen/logrus in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.8.3), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-400: Uncontrolled Resource Consumption, where the product does not properly control the allocation and maintenance of a limited resource. In Github.com/sirupsen/logrus, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2025-65637 Affected Github.com/sirupsen/logrus Versions
3 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/sirupsen/logrus
|
Go |
< 1.8.3
|
1.8.3
|
|
github.com/sirupsen/logrus
|
Go |
≥ 1.9.0
< 1.9.1
All 1 versions
1.9.0
|
1.9.1
|
|
github.com/sirupsen/logrus
|
Go |
≥ 1.9.2
< 1.9.3
All 1 versions
1.9.2
|
1.9.3
|
References
Frequently Asked Questions
What is CVE-2025-65637?
Which Github.com/sirupsen/logrus versions are affected?
What version fixes CVE-2025-65637?
Is github.com/sirupsen/logrus affected?
What CWE is associated with CVE-2025-65637?
How can I check Go dependencies for CVE-2025-65637?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-4f99-4q7p-p3gh",
"modified" : "2026-01-21T16:20:52Z",
"published" : "2025-12-04T21:31:04Z",
"aliases" : [ "CVE-2025-65637" ],
"summary" : "Logrus is vulnerable to DoS when using Entry.Writer()",
"details" : "A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with \"token too long\" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/sirupsen/logrus"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.8.3"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/sirupsen/logrus"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.9.0"
}, {
"fixed" : "1.9.1"
} ]
} ],
"versions" : [ "1.9.0" ]
}, {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/sirupsen/logrus"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.9.2"
}, {
"fixed" : "1.9.3"
} ]
} ],
"versions" : [ "1.9.2" ]
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-65637"
}, {
"type" : "WEB",
"url" : "https://github.com/sirupsen/logrus/issues/1370"
}, {
"type" : "WEB",
"url" : "https://github.com/sirupsen/logrus/pull/1376"
}, {
"type" : "WEB",
"url" : "https://github.com/sirupsen/logrus/commit/6acd903758687c4a3db3c11701e6c414fcf1c1f7"
}, {
"type" : "WEB",
"url" : "https://github.com/mjuanxd/logrus-dos-poc"
}, {
"type" : "WEB",
"url" : "https://github.com/mjuanxd/logrus-dos-poc/blob/main/README.md"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/sirupsen/logrus"
}, {
"type" : "WEB",
"url" : "https://github.com/sirupsen/logrus/releases/tag/v1.8.3"
}, {
"type" : "WEB",
"url" : "https://github.com/sirupsen/logrus/releases/tag/v1.9.1"
}, {
"type" : "WEB",
"url" : "https://github.com/sirupsen/logrus/releases/tag/v1.9.3"
}, {
"type" : "WEB",
"url" : "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSIRUPSENLOGRUS-5564391"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-400" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2025-12-05T02:27:47Z",
"nvd_published_at" : "2025-12-04T19:16:05Z"
}
}