VDB
RHSA-2026:1556
RHSA-2026:1556
PUBLISHED
CVSS 7.5 HIGH
A denial-of-service vulnerability in github.com/sirupsen/logrus occurs when Entry.Writer() processes a single-line payload larger than 64KB with no newline characters. Due to a limitation in Go’s internal bufio.Scanner, the read operation fails with a “token too long” error, causing the underlying writer pipe to close. In affected versions, this leaves the Writer interface unusable and can disrupt logging functionality, potentially degrading application availability.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-local-storage-rhel9-operator@sha256:6cfd91e537ae416bef5f668f0a4db86d4ee7e3efabef41f94f60c306515b5c02_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:16975db499564293ff3ab0bd8597cb393eef5b819e3b53ad449dbfb0f5d378c2_ppc64le as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel9@sha256:92003c9543eb69b29dcc63e54d82657679901c2e8b464224d181d0e1ef45af69_arm64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel9@sha256:9e2909100b905b51093b03f046d58a9387106b1123db43b6757dcd42b9564e95_ppc64le as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-vertical-pod-autoscaler-rhel9-operator@sha256:1bd28b06dfd84aee2bc968ad2d7651471e4bb8e3a4417e881fa2062ff3629bac_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | registry.redhat.io/openshift4/ose-vertical-pod-autoscaler-rhel9-operator@sha256:1bd28b06dfd84aee2bc968ad2d7651471e4bb8e3a4417e881fa2062ff3629bac_amd64 |
| Red Hat | registry.redhat.io/openshift4/pf-status-relay-rhel9-operator@sha256:147002bb7760f26a288f5c562378c6d0f9dd75cefc348a09cb0d6cd5126410f3_s390x as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-smb-csi-driver-rhel9-operator@sha256:d58022794e662a90c6202bfaf789d382412d1011268a6042c7786ca9905599c4_s390x as a component of Red Hat OpenShift Container Platform 4.20 | registry.redhat.io/openshift4/ose-smb-csi-driver-rhel9-operator@sha256:d58022794e662a90c6202bfaf789d382412d1011268a6042c7786ca9905599c4_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-node-feature-discovery-rhel9@sha256:129a70378c39a8cb736921f5207e94ae883cd289b660610395e6b6fd54577970_ppc64le as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:237758d6d13f5ccdb90b484305519e4b975873889bbfc3431c979b0315b0feed_s390x as a component of Red Hat OpenShift Container Platform 4.20 | registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:237758d6d13f5ccdb90b484305519e4b975873889bbfc3431c979b0315b0feed_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel9-operator@sha256:39d56d1921d1f2e68bf725d525f53f56608c6f4cd71631eebd691ca7566112a2_arm64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel9@sha256:c216b7a502c1b7b4c2202778617541c099ff3e19eef7ab72427676758bee6d44_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-smb-csi-driver-rhel9-operator@sha256:d58022794e662a90c6202bfaf789d382412d1011268a6042c7786ca9905599c4_s390x as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-local-storage-rhel9-operator@sha256:2def1cefddfceae1c286b1de5e6f3c46058427de87f2832893878e3b00bc8703_s390x as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-driver-rhel9-operator@sha256:eb9d92384287c28e92d58ec157d0bf99d4a9660e69bf73c995d7866d2e89b1fe_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | registry.redhat.io/openshift4/ose-secrets-store-csi-driver-rhel9-operator@sha256:eb9d92384287c28e92d58ec157d0bf99d4a9660e69bf73c995d7866d2e89b1fe_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-support-log-gather-rhel9-operator@sha256:118a31204e20b9eb9840c9127c36c3964b5caf72744b179a56f4cf3f0ce02661_arm64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-support-log-gather-rhel9-operator@sha256:827444379778bb6a54a11205bc92c2b828b1ab6d4d734fa16e94372c2b1ac1e2_s390x as a component of Red Hat OpenShift Container Platform 4.20 | registry.redhat.io/openshift4/ose-support-log-gather-rhel9-operator@sha256:827444379778bb6a54a11205bc92c2b828b1ab6d4d734fa16e94372c2b1ac1e2_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-driver-rhel9@sha256:06b8beaeda63e6eb242caee92b8d5bf125776f26bc0541d8028c8deaed883065_ppc64le as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ptp-must-gather-rhel9@sha256:b2d084d99edad49af8aac7c7dd458327389f69739e5f3ef666e64f1a11357598_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-dpu-daemon-rhel9@sha256:f98c9a7f150c39fc42de665eaf7b1cb80a068f788e2a50d451973c34ee488811_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-driver-rhel9@sha256:6a9c34588cfbb0d09253a0e7d6afa40b35ce0116fdb4e93f27750adc351a0155_s390x as a component of Red Hat OpenShift Container Platform 4.2 | * |
…and 334 more
Timeline
- Feb 4, 2026 CVE Published
- May 11, 2026 Distribution Patch
- May 13, 2026 CVE Updated
- May 15, 2026 Distribution Patch
- May 15, 2026 Security Advisory
- May 15, 2026 Security Advisory
References
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1556.json advisory
- https://www.cve.org/CVERecord?id=CVE-2025-65637 advisory
- https://github.com/mjuanxd/logrus-dos-poc exploit
- https://github.com/mjuanxd/logrus-dos-poc/blob/main/README.md exploit
- https://github.com/sirupsen/logrus/issues/1370 advisory
- https://github.com/sirupsen/logrus/releases/tag/v1.9.1 advisory
- https://access.redhat.com/errata/RHSA-2026:1556 advisory
- https://access.redhat.com/security/cve/CVE-2025-65637 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2418900 issue
- https://nvd.nist.gov/vuln/detail/CVE-2025-65637 advisory
- https://github.com/sirupsen/logrus/pull/1376 advisory
- https://github.com/sirupsen/logrus/releases/tag/v1.8.3 advisory
- https://github.com/sirupsen/logrus/releases/tag/v1.9.3 advisory
- https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSIRUPSENLOGRUS-5564391 advisory