VDB
RHSA-2026:2066
RHSA-2026:2066
PUBLISHED
CVSS 7.5 HIGH
A denial-of-service vulnerability in github.com/sirupsen/logrus occurs when Entry.Writer() processes a single-line payload larger than 64KB with no newline characters. Due to a limitation in Go’s internal bufio.Scanner, the read operation fails with a “token too long” error, causing the underlying writer pipe to close. In affected versions, this leaves the Writer interface unusable and can disrupt logging functionality, potentially degrading application availability.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-egress-router@sha256:8cc30585fb145eb252e68381b95fdce0c65d1d57d31acd6181fcee2f4a582820_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, registry.redhat.io/openshift4/ose-egress-router@sha256:8cc30585fb145eb252e68381b95fdce0c65d1d57d31acd6181fcee2f4a582820_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-helm-operator@sha256:192bedbd54f269fa48244feb4cff9dcdef2f30d4acf4dde7fa6ae037c584e6d9_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-ptp-operator@sha256:72c261f84ed1d5bf69b6ef25453e2a2451e9c0691a83f826a03248e8a6f63d83_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, registry.redhat.io/openshift4/ose-ptp-operator@sha256:72c261f84ed1d5bf69b6ef25453e2a2451e9c0691a83f826a03248e8a6f63d83_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-egress-http-proxy@sha256:be99dce9dc861ffb80a1c72fb451227267648225de0fddcce3646a5a789c3e94_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, registry.redhat.io/openshift4/ose-egress-http-proxy@sha256:be99dce9dc861ffb80a1c72fb451227267648225de0fddcce3646a5a789c3e94_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-local-storage-operator@sha256:9a40c06327303f279fb1ac249a8ac9537e04c6449f6a4e9c63f8463fa9e2794b_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, registry.redhat.io/openshift4/ose-local-storage-operator@sha256:9a40c06327303f279fb1ac249a8ac9537e04c6449f6a4e9c63f8463fa9e2794b_amd64 |
| Red Hat | registry.redhat.io/openshift4/metallb-rhel8@sha256:9ea2d3922ee064a18eb89b8306443273f33af318744b035c959ea60356884b6e_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | registry.redhat.io/openshift4/metallb-rhel8@sha256:9ea2d3922ee064a18eb89b8306443273f33af318744b035c959ea60356884b6e_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ptp-must-gather-rhel8@sha256:93cf12edc9c37e9189c5c2cbc432fdfb5ac433378a1f6729e5ecacf92d79f3c1_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, registry.redhat.io/openshift4/ptp-must-gather-rhel8@sha256:93cf12edc9c37e9189c5c2cbc432fdfb5ac433378a1f6729e5ecacf92d79f3c1_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-nfd-operator@sha256:50a6c05dc785902d6fcfedcd97365b33cbcbf600bca2c7a13e292e87bd671b02_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, registry.redhat.io/openshift4/ose-cluster-nfd-operator@sha256:50a6c05dc785902d6fcfedcd97365b33cbcbf600bca2c7a13e292e87bd671b02_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-cloud-event-proxy@sha256:8258ae40a04dbfa909bf29afb1756a233bb019dfc70f78122fb291c6847a357c_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, registry.redhat.io/openshift4/ose-cloud-event-proxy@sha256:8258ae40a04dbfa909bf29afb1756a233bb019dfc70f78122fb291c6847a357c_amd64 |
| Red Hat | registry.redhat.io/openshift4/cloud-event-proxy-rhel8@sha256:8258ae40a04dbfa909bf29afb1756a233bb019dfc70f78122fb291c6847a357c_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, registry.redhat.io/openshift4/cloud-event-proxy-rhel8@sha256:8258ae40a04dbfa909bf29afb1756a233bb019dfc70f78122fb291c6847a357c_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:4a0360b650e4465b1390c7082b02ff0777c73ef4abc5fd636c8416d92621a933_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | registry.redhat.io/openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:4a0360b650e4465b1390c7082b02ff0777c73ef4abc5fd636c8416d92621a933_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel8@sha256:1a2a56ba996e3cdf707001dfd5fa1fa52f97d97e7e7c0815db02bf99ff572430_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-network-device-plugin@sha256:936eb4613ce11977fa5d0ec82b3abb556cfdd5d02d4e75de591563f576a73745_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | registry.redhat.io/openshift4/ose-sriov-network-device-plugin@sha256:936eb4613ce11977fa5d0ec82b3abb556cfdd5d02d4e75de591563f576a73745_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel8@sha256:cbedeb54cb570ad2437cc352bb9768d63dbf46b4589dc1f4a3a4e43846fcfa13_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel8@sha256:cbedeb54cb570ad2437cc352bb9768d63dbf46b4589dc1f4a3a4e43846fcfa13_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-kubernetes-nmstate-handler-rhel8@sha256:27aed7d6d2ee476753e86cbc68c4a856b379a1d20eea12d1219ca8789b62ec3f_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, registry.redhat.io/openshift4/ose-kubernetes-nmstate-handler-rhel8@sha256:27aed7d6d2ee476753e86cbc68c4a856b379a1d20eea12d1219ca8789b62ec3f_amd64 |
| Red Hat | registry.redhat.io/openshift4/kubernetes-nmstate-rhel8-operator@sha256:40df6751b1a34e52d1266f4fbacbdf18137c9a4c3cfe8cc465f902f240cfbf74_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-capacity@sha256:986dae401c5d4b5247722e3d4f2e5b6e1239b2a807f423e45de9d8996cdddbee_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | registry.redhat.io/openshift4/ose-cluster-capacity@sha256:986dae401c5d4b5247722e3d4f2e5b6e1239b2a807f423e45de9d8996cdddbee_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-local-storage-diskmaker@sha256:e4feeb424cee0c92170b71bb7a1b1798b4edaebea6a5d2bf735160fd57a960a4_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, registry.redhat.io/openshift4/ose-local-storage-diskmaker@sha256:e4feeb424cee0c92170b71bb7a1b1798b4edaebea6a5d2bf735160fd57a960a4_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-ansible-operator@sha256:8bfef13a948f8bf5ff7678d6d8d14a557caaf99d781c14a9639720477c924527_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-node-feature-discovery@sha256:23e4ff6061fcc31fc74ce5c3c6b9ad0bad8018de3c22d92ec9b4c753d53a45aa_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | registry.redhat.io/openshift4/ose-node-feature-discovery@sha256:23e4ff6061fcc31fc74ce5c3c6b9ad0bad8018de3c22d92ec9b4c753d53a45aa_amd64, * |
…and 20 more
Timeline
- Feb 12, 2026 CVE Published
- May 11, 2026 Distribution Patch
- May 11, 2026 Security Advisory
- May 11, 2026 Security Advisory
- May 13, 2026 CVE Updated
- May 15, 2026 Distribution Patch
References
- https://access.redhat.com/errata/RHSA-2026:2066 advisory
- https://access.redhat.com/security/cve/CVE-2025-65637 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-65637 advisory
- https://github.com/mjuanxd/logrus-dos-poc/blob/main/README.md exploit
- https://github.com/sirupsen/logrus/issues/1370 advisory
- https://github.com/sirupsen/logrus/pull/1376 advisory
- https://github.com/sirupsen/logrus/releases/tag/v1.9.1 advisory
- https://github.com/sirupsen/logrus/releases/tag/v1.9.3 advisory
- https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSIRUPSENLOGRUS-5564391 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2066.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2418900 issue
- https://www.cve.org/CVERecord?id=CVE-2025-65637 advisory
- https://github.com/mjuanxd/logrus-dos-poc exploit
- https://github.com/sirupsen/logrus/releases/tag/v1.8.3 advisory