CVE-2025-27911
📋 TL;DR
This vulnerability in Datalust Seq allows attackers to bypass event body size limits by exploiting identifier expansion in message templates. This can lead to resource exhaustion through disk space depletion or out-of-memory server crashes. Organizations running vulnerable versions of Seq are affected.
💻 Affected Systems
- Datalust Seq
📦 What is this software?
Seq by Datalust
⚠️ Risk & Real-World Impact
Worst Case
Complete server outage due to out-of-memory termination or disk space exhaustion, potentially causing service disruption and data loss.
Likely Case
Degraded performance and intermittent service interruptions due to resource exhaustion, requiring manual intervention to restore normal operations.
If Mitigated
Minimal impact with proper monitoring and resource limits, though some performance degradation may still occur during attack attempts.
🎯 Exploit Status
The vulnerability appears straightforward to exploit by crafting malicious message templates that trigger excessive identifier expansion.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.3.13545 and later
Vendor Advisory: https://github.com/datalust/seq-tickets/issues/2365
Restart Required: Yes
Instructions:
1. Backup your Seq configuration and data. 2. Upgrade to Seq version 2024.3.13545 or later. 3. Restart the Seq service. 4. Verify the upgrade was successful.
🔧 Temporary Workarounds
Reduce Event Body Limit
allLower the maximum allowed event body size to limit potential damage from exploitation
seq config set -k "Seq:RawEventBodyLimitBytes" -v "1048576"
Implement Rate Limiting
allAdd network-level rate limiting to restrict the volume of incoming events
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Seq instances from untrusted networks
- Deploy monitoring and alerting for abnormal memory/disk usage patterns
🔍 How to Verify
Check if Vulnerable:
Check the Seq version; if it's earlier than 2024.3.13545, the system is vulnerable.Check Version:
seq versionVerify Fix Applied:
Confirm the version is 2024.3.13545 or later and test that large identifier expansions no longer bypass body limits.📡 Detection & Monitoring
Log Indicators:
- Unusually large event processing times
- Memory allocation errors
- Disk space warnings
- Server restart events
Network Indicators:
- Spikes in incoming event volume
- Patterns of repeated template submissions with large identifiers
SIEM Query:
source="seq" AND (event_size > threshold OR memory_usage > threshold) | stats count by host