VDB
RHSA-2026:1555
RHSA-2026:1555
PUBLISHED
CVSS 7.5 HIGH
A denial-of-service vulnerability in github.com/sirupsen/logrus occurs when Entry.Writer() processes a single-line payload larger than 64KB with no newline characters. Due to a limitation in Go’s internal bufio.Scanner, the read operation fails with a “token too long” error, causing the underlying writer pipe to close. In affected versions, this leaves the Writer interface unusable and can disrupt logging functionality, potentially degrading application availability.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-hyperkube-rhel9@sha256:2eb4e17061af22bdd0b86cb44a62f6707e0b1c6a6c123d6d8950c50978df87ec_ppc64le as a component of Red Hat OpenShift Container Platform 4.20 | registry.redhat.io/openshift4/ose-hyperkube-rhel9@sha256:2eb4e17061af22bdd0b86cb44a62f6707e0b1c6a6c123d6d8950c50978df87ec_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-version-rhel9-operator@sha256:db40eb2c54071df768459d563b07edd0bafe9c7a4b4b7d91f20e49b285d1f816_s390x as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-kube-apiserver-rhel9-operator@sha256:7a8cb75cf04719b8034be238eb51db106aba9c5b2c078cec7edfe1b43433c92b_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-workload-identity-federation-webhook-rhel9@sha256:af76096d455c2787c46e447e55991ee28fbfc6e0641b161dea00a1fec0fc1e2d_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | registry.redhat.io/openshift4/ose-gcp-workload-identity-federation-webhook-rhel9@sha256:af76096d455c2787c46e447e55991ee28fbfc6e0641b161dea00a1fec0fc1e2d_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-openshift-apiserver-rhel9@sha256:74e8c4938140bceb1fc462e2c258808d8c1efce20fa8886ef4f3e57111424fdf_ppc64le as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-baremetal-installer-rhel9@sha256:d4d031141a3c2f801c415174fbfddcc67a46ec35ac7c9c523aaa7d8f347506b9_ppc64le as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-livenessprobe-rhel9@sha256:17e5a2e5de57f823ae658fbc52ba0eca08339c8668acd1de3cd55e796bb4d835_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-vsphere-csi-driver-rhel9@sha256:03bda40acdebf88e2e44fb1954ccf72a92f26b8a9d16d2111645af6bc02fa470_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-thanos-rhel9@sha256:a4b8598a64c02ae4014f5edb6d83c04263554e5264706d9805abc1a845272eac_ppc64le as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-baremetal-cluster-api-controllers-rhel9@sha256:d38418d75e2c1d547fad8aa49fbc13305ad515c834f982016ad6d95bf998a826_arm64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/insights-runtime-extractor-rhel9@sha256:daee6e1c9a7df1bc286f4fcd4a79ceae3675625c62cda23f0e9dd3a2ac550920_s390x as a component of Red Hat OpenShift Container Platform 4.20 | registry.redhat.io/openshift4/insights-runtime-extractor-rhel9@sha256:daee6e1c9a7df1bc286f4fcd4a79ceae3675625c62cda23f0e9dd3a2ac550920_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-kube-state-metrics-rhel9@sha256:40937e7e7792d85e446c58c9828d6ccb678605c897e8bc39f851c24ab8caec6a_s390x as a component of Red Hat OpenShift Container Platform 4.20 | registry.redhat.io/openshift4/ose-kube-state-metrics-rhel9@sha256:40937e7e7792d85e446c58c9828d6ccb678605c897e8bc39f851c24ab8caec6a_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9-operator@sha256:ceb1beb2060ded10c43009b1f27f94f0b91feadd10542e1f4234c286d6ad653e_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9-operator@sha256:ceb1beb2060ded10c43009b1f27f94f0b91feadd10542e1f4234c286d6ad653e_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-prometheus-alertmanager-rhel9@sha256:a6fd8de3f710242117eb4b2025710e73e791a740e7cc2e0338abdc250e31881c_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | registry.redhat.io/openshift4/ose-prometheus-alertmanager-rhel9@sha256:a6fd8de3f710242117eb4b2025710e73e791a740e7cc2e0338abdc250e31881c_arm64 |
| Red Hat | registry.redhat.io/openshift4/oc-mirror-plugin-rhel9@sha256:4d9557543158f339032c9c37b771e0bdf7ee175ef4c95d1b9484efe0841a676a_ppc64le as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-oauth-proxy-rhel9@sha256:8733167fa23aa6db9b5ec3a0d85cf3d0536e339e0f39ccc794577c19a5119106_s390x as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-openshift-controller-manager-rhel9@sha256:ba9d35ef6b61a3ba76b9d7f13764f3d18c5779e18ba1580c788d7683f7b97fbf_arm64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-kube-storage-version-migrator-rhel9-operator@sha256:cb17aff3f0f9107e83886d2313fee6388c94018bbf714cf73cf3ec592ed15d92_ppc64le as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-control-plane-machine-set-rhel9-operator@sha256:93df53e41b59d5be5041925ff0f049acd614b22f5f4ef59715f647781f5921ea_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-openstack-cinder-csi-driver-rhel9@sha256:475ad8f6bd57de2a9b411e396d1c4cb688ef9374ff93c3c6b2e1f03383b09b92_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | registry.redhat.io/openshift4/ose-openstack-cinder-csi-driver-rhel9@sha256:475ad8f6bd57de2a9b411e396d1c4cb688ef9374ff93c3c6b2e1f03383b09b92_amd64 |
…and 1314 more
Timeline
- Feb 4, 2026 CVE Published
- May 11, 2026 Security Advisory
- May 13, 2026 CVE Updated
- May 15, 2026 Distribution Patch
- May 15, 2026 Distribution Patch
- May 15, 2026 Security Advisory
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2418900 issue
- https://www.cve.org/CVERecord?id=CVE-2025-65637 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-65637 advisory
- https://github.com/mjuanxd/logrus-dos-poc/blob/main/README.md exploit
- https://github.com/sirupsen/logrus/pull/1376 advisory
- https://github.com/sirupsen/logrus/releases/tag/v1.9.1 advisory
- https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSIRUPSENLOGRUS-5564391 advisory
- https://access.redhat.com/errata/RHSA-2026:1555 advisory
- https://access.redhat.com/security/cve/CVE-2025-65637 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1555.json advisory
- https://github.com/mjuanxd/logrus-dos-poc exploit
- https://github.com/sirupsen/logrus/issues/1370 advisory
- https://github.com/sirupsen/logrus/releases/tag/v1.8.3 advisory
- https://github.com/sirupsen/logrus/releases/tag/v1.9.3 advisory