VDB
RHSA-2026%3A2978
RHSA-2026%3A2978
PUBLISHED
CVSS 7.5 HIGH
A denial-of-service vulnerability in github.com/sirupsen/logrus occurs when Entry.Writer() processes a single-line payload larger than 64KB with no newline characters. Due to a limitation in Go’s internal bufio.Scanner, the read operation fails with a “token too long” error, causing the underlying writer pipe to close. In affected versions, this leaves the Writer interface unusable and can disrupt logging functionality, potentially degrading application availability.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-local-storage-mustgather-rhel9@sha256:c0fe7640c7d2763e4162dc90ccff929db8725845e8aca09ed3c311edf7c579b8_s390x as a component of Red Hat OpenShift Container Platform 4.18 | registry.redhat.io/openshift4/ose-local-storage-mustgather-rhel9@sha256:c0fe7640c7d2763e4162dc90ccff929db8725845e8aca09ed3c311edf7c579b8_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-dpu-cni-rhel9@sha256:a9b1a39d9666c580fe3e59464de25ca36cb6c8fa86d0c7fc1315955e127f0d71_ppc64le as a component of Red Hat OpenShift Container Platform 4.18 | registry.redhat.io/openshift4/ose-dpu-cni-rhel9@sha256:a9b1a39d9666c580fe3e59464de25ca36cb6c8fa86d0c7fc1315955e127f0d71_ppc64le, * |
| Red Hat | registry.redhat.io/openshift4/ose-ptp-rhel9@sha256:ceee4eb01fc1ec92d2c6e5eca50fc8b363f3bb0d97fa97a808ebba5bcbdb2d40_ppc64le as a component of Red Hat OpenShift Container Platform 4.18 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-local-storage-mustgather-rhel9@sha256:6b6fd49293914c4435c9c0319954ecd7fba75368bd5659c0cbb4caf0f1623939_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | registry.redhat.io/openshift4/ose-local-storage-mustgather-rhel9@sha256:6b6fd49293914c4435c9c0319954ecd7fba75368bd5659c0cbb4caf0f1623939_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-dpu-daemon-rhel9@sha256:73f04e97978916aa3a584f506831274d111a9eb02ba7382da1be79c001dd81b3_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | registry.redhat.io/openshift4/ose-dpu-daemon-rhel9@sha256:73f04e97978916aa3a584f506831274d111a9eb02ba7382da1be79c001dd81b3_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel9@sha256:38b0ec1d9a23ce79503bf65163249646ca6ce9b00b084ca5a3a40618ece4a11d_amd64 as a component of Red Hat OpenShift Container Platform 4.18 | registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel9@sha256:38b0ec1d9a23ce79503bf65163249646ca6ce9b00b084ca5a3a40618ece4a11d_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-driver-rhel9@sha256:3ec4aa8896804c667ea183e7d5a43db775cb7cba8f523e7c0049484a13ee0b37_ppc64le as a component of Red Hat OpenShift Container Platform 4.18 | registry.redhat.io/openshift4/ose-secrets-store-csi-driver-rhel9@sha256:3ec4aa8896804c667ea183e7d5a43db775cb7cba8f523e7c0049484a13ee0b37_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-aws-efs-csi-driver-rhel9-operator@sha256:72d4d8324818d326a5c8435da02f660b107140389c1b9c77b5114d6797e42b98_amd64 as a component of Red Hat OpenShift Container Platform 4.18 | registry.redhat.io/openshift4/ose-aws-efs-csi-driver-rhel9-operator@sha256:72d4d8324818d326a5c8435da02f660b107140389c1b9c77b5114d6797e42b98_amd64 |
| Red Hat | registry.redhat.io/openshift4/pf-status-relay-rhel9-operator@sha256:806451cdeb59952994fdbdcf6ec4e64646279a04ad0c2dfb44b4504e3f22fab8_amd64 as a component of Red Hat OpenShift Container Platform 4.18 | *, * |
| Red Hat | registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:3d6570250ff35100eebed8e01e2ca10c6c66f3dd4496fd186610ea2d6a5ae994_s390x as a component of Red Hat OpenShift Container Platform 4.18 | * |
| Red Hat | registry.redhat.io/openshift4/metallb-rhel9@sha256:544a82ee370384d61fb038509f5391024020be9d383c946d0cc788d3a20e57c7_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel9@sha256:177cc1f694269d41793a0dea3f08b0b49d6aa1ff1e47d77e61e444625e6025f9_ppc64le as a component of Red Hat OpenShift Container Platform 4.18 | *, registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel9@sha256:177cc1f694269d41793a0dea3f08b0b49d6aa1ff1e47d77e61e444625e6025f9_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-nfd-rhel9-operator@sha256:40e4a9c2ddf265133e616e5049294f60a52cbe28ecfd70d4e05368d3c30471aa_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | registry.redhat.io/openshift4/ose-cluster-nfd-rhel9-operator@sha256:40e4a9c2ddf265133e616e5049294f60a52cbe28ecfd70d4e05368d3c30471aa_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-aws-efs-csi-driver-rhel9-operator@sha256:72d4d8324818d326a5c8435da02f660b107140389c1b9c77b5114d6797e42b98_amd64 as a component of Red Hat OpenShift Container Platform 4.18 | *, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-rhel9-operator@sha256:72d4d8324818d326a5c8435da02f660b107140389c1b9c77b5114d6797e42b98_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-dpu-rhel9-operator@sha256:b2ed51846c476657a7f082fb0c7eea73a6bdbe54dfc77705412fae33fda99437_s390x as a component of Red Hat OpenShift Container Platform 4.18 | *, registry.redhat.io/openshift4/ose-dpu-rhel9-operator@sha256:b2ed51846c476657a7f082fb0c7eea73a6bdbe54dfc77705412fae33fda99437_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-dpu-cni-rhel9@sha256:4f8218377f0a863f9eba9dfd2e10134950307301a140c5248e22e6504d7d7e75_amd64 as a component of Red Hat OpenShift Container Platform 4.18 | registry.redhat.io/openshift4/ose-dpu-cni-rhel9@sha256:4f8218377f0a863f9eba9dfd2e10134950307301a140c5248e22e6504d7d7e75_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-smb-csi-driver-rhel9-operator@sha256:241f8b76a8c33f87bc7caf8f9e400236fffbbb68096a1be16a838d4613846fa0_ppc64le as a component of Red Hat OpenShift Container Platform 4.18 | registry.redhat.io/openshift4/ose-smb-csi-driver-rhel9-operator@sha256:241f8b76a8c33f87bc7caf8f9e400236fffbbb68096a1be16a838d4613846fa0_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-dpu-daemon-rhel9@sha256:261c096271e3dfed7217c511dd5f0267d5fbbf6180f95c1a9879680d0ee9a740_ppc64le as a component of Red Hat OpenShift Container Platform 4.18 | registry.redhat.io/openshift4/ose-dpu-daemon-rhel9@sha256:261c096271e3dfed7217c511dd5f0267d5fbbf6180f95c1a9879680d0ee9a740_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:854fb330b8415a8f54bf9be39018ec5482730d68312feafe7ed3366d72da88e4_ppc64le as a component of Red Hat OpenShift Container Platform 4.18 | *, registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:854fb330b8415a8f54bf9be39018ec5482730d68312feafe7ed3366d72da88e4_ppc64le |
| Red Hat | registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:f847b1250f721e4edaf9cee52b50ec70c7ecd49934cf303ef8ccc5054781a707_amd64 as a component of Red Hat OpenShift Container Platform 4.18 | registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:f847b1250f721e4edaf9cee52b50ec70c7ecd49934cf303ef8ccc5054781a707_amd64 |
…and 362 more
Timeline
- Feb 25, 2026 CVE Published
- Apr 29, 2026 Distribution Patch
- Apr 29, 2026 Distribution Patch
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- May 13, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:2978 advisory
- https://access.redhat.com/security/cve/CVE-2025-65637 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2978.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2418900 issue
- https://www.cve.org/CVERecord?id=CVE-2025-65637 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-65637 advisory
- https://github.com/mjuanxd/logrus-dos-poc exploit
- https://github.com/mjuanxd/logrus-dos-poc/blob/main/README.md exploit
- https://github.com/sirupsen/logrus/issues/1370 advisory
- https://github.com/sirupsen/logrus/pull/1376 advisory
- https://github.com/sirupsen/logrus/releases/tag/v1.8.3 advisory
- https://github.com/sirupsen/logrus/releases/tag/v1.9.1 advisory
- https://github.com/sirupsen/logrus/releases/tag/v1.9.3 advisory
- https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSIRUPSENLOGRUS-5564391 advisory