Dashboard / CVE-2025-65637

CVE-2025-65637

HIGH 1 PoC
MEDIUM Priority: 0.05 BB Relevance: 85/100
Published: 2025-12-04 Modified: 2026-11-04 First seen: 2026-11-04 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: None
I: None
A: High

Description

A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.

Weakness Classification (1)

Affected Software (3)

VendorProductVersion
turbopuffer logrus < 1.8.3
turbopuffer logrus 1.9.0
turbopuffer logrus 1.9.2

References & Advisories (8)

https://github.com/mjuanxd/logrus-dos-poc
Exploit Third Party Advisory
https://github.com/sirupsen/logrus/issues/1370
Exploit Issue Tracking Patch

Proof of Concept (1)

★ 2
https://github.com/mjuanxd/logrus-dos-poc
nomi-sec

Bug Bounty Relevance

85 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction
✓ PoC available (1)

CVSS Score

7.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS — Exploitation Probability

0.68%
Raw Score 0.006750
Percentile 52.5%
Date 2026-11-08

EPSS Trend

2026-11-08
0.00675
2026-11-07
0.00675
2026-11-06
0.00675
2026-11-05
0.00675
2026-11-04
0.00675

Intelligence Sources

nvd ref →

External Links