VDB
RHSA-2026:2065
RHSA-2026:2065
PUBLISHED
CVSS 7.5 HIGH
A denial-of-service vulnerability in github.com/sirupsen/logrus occurs when Entry.Writer() processes a single-line payload larger than 64KB with no newline characters. Due to a limitation in Go’s internal bufio.Scanner, the read operation fails with a “token too long” error, causing the underlying writer pipe to close. In affected versions, this leaves the Writer interface unusable and can disrupt logging functionality, potentially degrading application availability.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-csi-driver-shared-resource-rhel8@sha256:fc1741a7db4a0b61c771159c59e0241c80ef3ebc7424858a2669b022822c05a3_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, registry.redhat.io/openshift4/ose-csi-driver-shared-resource-rhel8@sha256:fc1741a7db4a0b61c771159c59e0241c80ef3ebc7424858a2669b022822c05a3_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-libvirt-machine-controllers@sha256:20e00ab2af71696f2e7e96ae08e0988bbd1de35bb00860c1b98cff84beb6f475_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | registry.redhat.io/openshift4/ose-libvirt-machine-controllers@sha256:20e00ab2af71696f2e7e96ae08e0988bbd1de35bb00860c1b98cff84beb6f475_amd64, * |
| Red Hat | registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8@sha256:ff3e40f0ce278d9bc47c17675196f54940f7ce61d36681556c602c10e424e6d7_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8@sha256:ff3e40f0ce278d9bc47c17675196f54940f7ce61d36681556c602c10e424e6d7_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-ibm-vpc-block-csi-driver-operator-rhel8@sha256:65e393e2d35de522e3d571cf1377ae410cfe220db7713cb2b2dc95e26c928a59_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | registry.redhat.io/openshift4/ose-ibm-vpc-block-csi-driver-operator-rhel8@sha256:65e393e2d35de522e3d571cf1377ae410cfe220db7713cb2b2dc95e26c928a59_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-console-operator@sha256:e64ce8b7bb4508f584e59600388df1b61895eab99bdca5021add66dfe2efe604_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | registry.redhat.io/openshift4/ose-console-operator@sha256:e64ce8b7bb4508f584e59600388df1b61895eab99bdca5021add66dfe2efe604_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-version-operator@sha256:92fda75e1271d07758d82b89214ed7a3e28875e1c4c119e3893c4e4a546ae093_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | registry.redhat.io/openshift4/ose-cluster-version-operator@sha256:92fda75e1271d07758d82b89214ed7a3e28875e1c4c119e3893c4e4a546ae093_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-monitoring-operator@sha256:a0b744bcf5f433badf07c9efbd0fc3fed3f28330be67a42b412f048744693ddd_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, registry.redhat.io/openshift4/ose-cluster-monitoring-operator@sha256:a0b744bcf5f433badf07c9efbd0fc3fed3f28330be67a42b412f048744693ddd_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-storage-operator@sha256:fb341b0f6cc9964f910ff9db666bcd3efd8f5015fdec761aff84c0e328fab7d8_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, registry.redhat.io/openshift4/ose-cluster-storage-operator@sha256:fb341b0f6cc9964f910ff9db666bcd3efd8f5015fdec761aff84c0e328fab7d8_amd64 |
| Red Hat | registry.redhat.io/openshift4/driver-toolkit-rhel8@sha256:f1d32838fca6a106b3d65cada1f9571fd58360b7fe768151755881b82236d071_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, registry.redhat.io/openshift4/driver-toolkit-rhel8@sha256:f1d32838fca6a106b3d65cada1f9571fd58360b7fe768151755881b82236d071_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-csi-snapshot-validation-webhook-rhel8@sha256:39bde5adb7fde8cb8d0ba91d801caf414ee1ba778fe42c574b184c805194aec3_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, registry.redhat.io/openshift4/ose-csi-snapshot-validation-webhook-rhel8@sha256:39bde5adb7fde8cb8d0ba91d801caf414ee1ba778fe42c574b184c805194aec3_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-control-plane-machine-set-operator-rhel8@sha256:e5f6a2133f356ab6219c33bc49d85af29828fb85b2c0356e4be1b76da6b89bf2_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | registry.redhat.io/openshift4/ose-cluster-control-plane-machine-set-operator-rhel8@sha256:e5f6a2133f356ab6219c33bc49d85af29828fb85b2c0356e4be1b76da6b89bf2_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-thanos-rhel8@sha256:24769be6e48c61dd5346218a68d793168952950d35c41d7902b1c141f861de9b_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-insights-rhel8-operator@sha256:0df84b1fbff366dbb73424c75d116a3b3746fd257d5b5b0cf4ae33be24f437f3_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, registry.redhat.io/openshift4/ose-insights-rhel8-operator@sha256:0df84b1fbff366dbb73424c75d116a3b3746fd257d5b5b0cf4ae33be24f437f3_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-installer-artifacts@sha256:8e62ef0a1d42d839781c020066aafcf197fd71cf04bbde0ff9abb893a9c64423_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-openshift-controller-manager-operator@sha256:154274cef0bcb1d1529dfe118bcbfd1a148cf2f6f13fde31e04ac284dd1e598f_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, registry.redhat.io/openshift4/ose-cluster-openshift-controller-manager-operator@sha256:154274cef0bcb1d1529dfe118bcbfd1a148cf2f6f13fde31e04ac284dd1e598f_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-container-networking-plugins-rhel8@sha256:9ccfa9f3a2174ae6e72d6c9e61fdc28f45ea2b6dd93b5eca1df3569c15899826_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, registry.redhat.io/openshift4/ose-container-networking-plugins-rhel8@sha256:9ccfa9f3a2174ae6e72d6c9e61fdc28f45ea2b6dd93b5eca1df3569c15899826_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-cloud-controller-manager-operator-rhel8@sha256:51f4fefe055210fc0f683bcb4bbb1f9cdde8e81f2189a0c4354539b462f5de1d_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator@sha256:da50a8cb34d6e5de305fbd31cd7093579d2e9f4c167f431874e93860642cf0fa_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-azure-cloud-node-manager-rhel8@sha256:bf6a0425e4da30147d9d8e4915d32cba811d836bf2ddfda93d22e2e2e7eb03fe_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | registry.redhat.io/openshift4/ose-azure-cloud-node-manager-rhel8@sha256:bf6a0425e4da30147d9d8e4915d32cba811d836bf2ddfda93d22e2e2e7eb03fe_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-pd-csi-driver-operator-rhel8@sha256:0fbf9cf75ea4ea60ed8635880775d619171ed92b19b5541b51b303ed6ba43180_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
…and 170 more
Timeline
- Feb 12, 2026 CVE Published
- May 11, 2026 Security Advisory
- May 13, 2026 CVE Updated
- May 15, 2026 Distribution Patch
- May 15, 2026 Distribution Patch
- May 15, 2026 Security Advisory
References
- https://access.redhat.com/security/cve/CVE-2025-65637 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2418900 issue
- https://www.cve.org/CVERecord?id=CVE-2025-65637 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-65637 advisory
- https://github.com/mjuanxd/logrus-dos-poc exploit
- https://github.com/sirupsen/logrus/issues/1370 advisory
- https://github.com/sirupsen/logrus/pull/1376 advisory
- https://github.com/sirupsen/logrus/releases/tag/v1.9.1 advisory
- https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSIRUPSENLOGRUS-5564391 advisory
- https://access.redhat.com/errata/RHSA-2026:2065 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2065.json advisory
- https://github.com/mjuanxd/logrus-dos-poc/blob/main/README.md exploit
- https://github.com/sirupsen/logrus/releases/tag/v1.8.3 advisory
- https://github.com/sirupsen/logrus/releases/tag/v1.9.3 advisory