VDB
RHSA-2026%3A3419
RHSA-2026%3A3419
PUBLISHED
CVSS 7.5 HIGH
A denial-of-service vulnerability in github.com/sirupsen/logrus occurs when Entry.Writer() processes a single-line payload larger than 64KB with no newline characters. Due to a limitation in Go’s internal bufio.Scanner, the read operation fails with a “token too long” error, causing the underlying writer pipe to close. In affected versions, this leaves the Writer interface unusable and can disrupt logging functionality, potentially degrading application availability.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:f60f80f264e9e17839441965b04b5069859c241ecaa6f8532b2f4ff417385abb_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-dpu-cni-rhel9@sha256:8914c13ea1737e8cde7c3a995da925b3b502f271f76bffab2954defd05f55f6c_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-dpu-cni-rhel9@sha256:8914c13ea1737e8cde7c3a995da925b3b502f271f76bffab2954defd05f55f6c_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-operator-sdk-rhel9@sha256:be55e324826321f15000b5c406c663ed4e34724834dd0bc0a9482f8be980794d_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:3bda6a46393f882283b443e4d4457a6036729e4b4b92c71a78506028cd769975_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | *, registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:3bda6a46393f882283b443e4d4457a6036729e4b4b92c71a78506028cd769975_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-driver-rhel9@sha256:4de3b9bf359d1f25cda067932b5b94b8209d936734bcb0913b2a98261c3e1518_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-secrets-store-csi-driver-rhel9@sha256:4de3b9bf359d1f25cda067932b5b94b8209d936734bcb0913b2a98261c3e1518_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-vertical-pod-autoscaler-rhel9-operator@sha256:61fd0866eb42d944790c63cb745c573bd5198a18a52d71ac0a28142cc7a5e84c_s390x as a component of Red Hat OpenShift Container Platform 4.17 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-mustgather-rhel9@sha256:8bb9f6fc66d2df16484f545cd1175fd2aee2f1603ade0c72eb29413ea206771b_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-secrets-store-csi-mustgather-rhel9@sha256:8bb9f6fc66d2df16484f545cd1175fd2aee2f1603ade0c72eb29413ea206771b_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-ptp-rhel9-operator@sha256:1df66867985a503a2424dd5afe3fc6358d6acd9360e38f5e2a2ff092486e3530_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-ptp-rhel9-operator@sha256:1df66867985a503a2424dd5afe3fc6358d6acd9360e38f5e2a2ff092486e3530_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:bcbedda8a7901888967bbf6080db80c2ac53841f6671ad5bd40059098ad37faf_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:bcbedda8a7901888967bbf6080db80c2ac53841f6671ad5bd40059098ad37faf_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel9-operator@sha256:8436f57608292b9a80a2c6403f3f4df4c4129b755e98221d32c63155a34e7345_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel9-operator@sha256:8436f57608292b9a80a2c6403f3f4df4c4129b755e98221d32c63155a34e7345_ppc64le, * |
| Red Hat | registry.redhat.io/openshift4/ose-cloud-event-proxy-rhel9@sha256:ae09a699df739d3f7838ea0a6f15d428a3086e36b187464ef40616bbe8e5e087_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-cloud-event-proxy-rhel9@sha256:ae09a699df739d3f7838ea0a6f15d428a3086e36b187464ef40616bbe8e5e087_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-dpu-daemon-rhel9@sha256:bb64c2821a151c645875f940ace8c0487e1ccb555ec4ea848ed619fb5addcba2_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-dpu-daemon-rhel9@sha256:bb64c2821a151c645875f940ace8c0487e1ccb555ec4ea848ed619fb5addcba2_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:00a02d79517c6f87eb3206abed01307253602b17b6cdb069f693f63535b0ea7c_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-sriov-network-webhook-rhel9@sha256:00a02d79517c6f87eb3206abed01307253602b17b6cdb069f693f63535b0ea7c_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-capacity-rhel9@sha256:e5609718b24be48667ed1f100a46b3e51dad8412c2cbfb12257bfe111ca4c3a9_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-cluster-capacity-rhel9@sha256:e5609718b24be48667ed1f100a46b3e51dad8412c2cbfb12257bfe111ca4c3a9_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-dpu-daemon-rhel9@sha256:62ec8ef7fc23a5965b22cc55c96175ce8e25673829c539ff71814915472b08ff_s390x as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel9@sha256:98430802f1221ae8e78cfdc037508e4af7e8cdca85b7172dd32e8114b655365d_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel9@sha256:98430802f1221ae8e78cfdc037508e4af7e8cdca85b7172dd32e8114b655365d_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel9@sha256:3ed15e7c20d6c87587187a1ef5f66da30b5fafd14e0cec71bf75f4813c897270_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel9@sha256:3ed15e7c20d6c87587187a1ef5f66da30b5fafd14e0cec71bf75f4813c897270_amd64 |
| Red Hat | registry.redhat.io/openshift4/metallb-rhel9@sha256:a75874e120841d97e91a99de51ad19f494ffbeced693470b813524cf70234211_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-driver-rhel9-operator@sha256:1a5d91c6f8b7708285ec32bf3554d4c2e0f459b019465e87d012ba1e22aaf717_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | *, registry.redhat.io/openshift4/ose-secrets-store-csi-driver-rhel9-operator@sha256:1a5d91c6f8b7708285ec32bf3554d4c2e0f459b019465e87d012ba1e22aaf717_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-aws-efs-csi-driver-rhel9-operator@sha256:f7fd1b0e019b56a84fe26d9bc2a16a2573f0d6692e15ee16e339d130278e12e4_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | registry.redhat.io/openshift4/ose-aws-efs-csi-driver-rhel9-operator@sha256:f7fd1b0e019b56a84fe26d9bc2a16a2573f0d6692e15ee16e339d130278e12e4_arm64 |
…and 346 more
Timeline
- Mar 4, 2026 CVE Published
- Apr 29, 2026 Distribution Patch
- Apr 29, 2026 Distribution Patch
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- May 13, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:3419 advisory
- https://access.redhat.com/security/cve/CVE-2025-65637 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3419.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2418900 issue
- https://www.cve.org/CVERecord?id=CVE-2025-65637 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-65637 advisory
- https://github.com/mjuanxd/logrus-dos-poc exploit
- https://github.com/mjuanxd/logrus-dos-poc/blob/main/README.md exploit
- https://github.com/sirupsen/logrus/issues/1370 advisory
- https://github.com/sirupsen/logrus/pull/1376 advisory
- https://github.com/sirupsen/logrus/releases/tag/v1.8.3 advisory
- https://github.com/sirupsen/logrus/releases/tag/v1.9.1 advisory
- https://github.com/sirupsen/logrus/releases/tag/v1.9.3 advisory
- https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSIRUPSENLOGRUS-5564391 advisory