CVE-2025-65637
📋 TL;DR
A denial-of-service vulnerability in the logrus logging library allows attackers to crash applications by logging single-line payloads larger than 64KB without newline characters. This affects applications using Entry.Writer() in vulnerable versions, causing the writer pipe to close and making logging unavailable. The vulnerability impacts all applications using affected logrus versions in their Go projects.
💻 Affected Systems
- github.com/sirupsen/logrus
📦 What is this software?
Logrus by Turbopuffer
Logrus by Turbopuffer
Logrus by Turbopuffer
⚠️ Risk & Real-World Impact
Worst Case
Application becomes completely unavailable due to logging subsystem failure, requiring restart to recover functionality.
Likely Case
Application logging stops working, potentially causing cascading failures in dependent systems or making debugging impossible.
If Mitigated
Application continues to function with degraded logging capability, but core functionality remains operational.
🎯 Exploit Status
Exploitation requires ability to control log input content. Public proof-of-concept demonstrates reliable DoS.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.3, 1.9.1, or 1.9.3+
Vendor Advisory: https://github.com/sirupsen/logrus/releases/tag/v1.8.3
Restart Required: Yes
Instructions:
1. Update go.mod to require logrus >= 1.8.3, 1.9.1, or >= 1.9.3. 2. Run 'go mod tidy'. 3. Rebuild and redeploy application. 4. Restart all affected services.
🔧 Temporary Workarounds
Input validation and truncation
allAdd middleware or wrapper to validate and truncate log entries before passing to Entry.Writer()
// Go code example: if len(logEntry) > 65535 { logEntry = logEntry[:65535] }
Avoid Entry.Writer() for untrusted input
allUse alternative logging methods that don't use Entry.Writer() for user-controlled content
// Use logrus.StandardLogger() or direct logging methods instead
🧯 If You Can't Patch
- Implement strict input validation to reject log entries larger than 64KB
- Deploy application behind WAF with payload size limits and anomaly detection
🔍 How to Verify
Check if Vulnerable:
Check go.mod or vendor directory for logrus version. Run: grep -r 'sirupsen/logrus' go.modCheck Version:
go list -m github.com/sirupsen/logrusVerify Fix Applied:
Verify updated version in go.mod and test logging with large single-line payloads📡 Detection & Monitoring
Log Indicators:
- 'token too long' errors in application logs
- Sudden cessation of logging output
- Application crashes or restarts
Network Indicators:
- Unusual large payloads to logging endpoints
- Increased error rates in monitoring
SIEM Query:
source="application.logs" AND ("token too long" OR "bufio.Scanner: token too long")🔗 References
- https://github.com/mjuanxd/logrus-dos-poc
- https://github.com/mjuanxd/logrus-dos-poc/blob/main/README.md
- https://github.com/sirupsen/logrus/issues/1370
- https://github.com/sirupsen/logrus/pull/1376
- https://github.com/sirupsen/logrus/releases/tag/v1.8.3
- https://github.com/sirupsen/logrus/releases/tag/v1.9.1
- https://github.com/sirupsen/logrus/releases/tag/v1.9.3
- https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSIRUPSENLOGRUS-5564391
