VDB
RHSA-2026:2079
RHSA-2026:2079
PUBLISHED
CVSS 7.5 HIGH
A denial-of-service vulnerability in github.com/sirupsen/logrus occurs when Entry.Writer() processes a single-line payload larger than 64KB with no newline characters. Due to a limitation in Go’s internal bufio.Scanner, the read operation fails with a “token too long” error, causing the underlying writer pipe to close. In affected versions, this leaves the Writer interface unusable and can disrupt logging functionality, potentially degrading application availability.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:c87a5e010bdb00a7c22e41e8823ad940272a73337956146269e008b2903e529a_ppc64le as a component of Red Hat OpenShift Container Platform 4.18 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-egress-dns-proxy-rhel9@sha256:f29d0689269562d9ba94cd68e24e90eb53ecd1cbbf29b7bc1f782ab1fae00a99_s390x as a component of Red Hat OpenShift Container Platform 4.18 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:60d0215af0c870ba2981e4673e68fbc8ace9cea979cd5528c855c5a15cbba7ae_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | registry.redhat.io/openshift4/ose-sriov-dp-admission-controller-rhel9@sha256:60d0215af0c870ba2981e4673e68fbc8ace9cea979cd5528c855c5a15cbba7ae_arm64, * |
| Red Hat | registry.redhat.io/openshift4/sriov-network-metrics-exporter-rhel9@sha256:c87a5e010bdb00a7c22e41e8823ad940272a73337956146269e008b2903e529a_ppc64le as a component of Red Hat OpenShift Container Platform 4.18 | registry.redhat.io/openshift4/sriov-network-metrics-exporter-rhel9@sha256:c87a5e010bdb00a7c22e41e8823ad940272a73337956146269e008b2903e529a_ppc64le, * |
| Red Hat | registry.redhat.io/openshift4/ose-node-feature-discovery-rhel9@sha256:73c16d30c56cfb4e06e2ec55bda919904424b1253c2decb59db7c4cd34183871_amd64 as a component of Red Hat OpenShift Container Platform 4.18 | registry.redhat.io/openshift4/ose-node-feature-discovery-rhel9@sha256:73c16d30c56cfb4e06e2ec55bda919904424b1253c2decb59db7c4cd34183871_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-dpu-daemon-rhel9@sha256:d9efa56d3b0f6ea49c6275aea48ff119957dfbab693e25e1d4bb935da0035a75_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cloud-event-proxy-rhel9@sha256:acbdac7af1e3cbadadb79bc549b31731bb1d39f63a0b419c26e52514c31279f1_ppc64le as a component of Red Hat OpenShift Container Platform 4.18 | registry.redhat.io/openshift4/ose-cloud-event-proxy-rhel9@sha256:acbdac7af1e3cbadadb79bc549b31731bb1d39f63a0b419c26e52514c31279f1_ppc64le, * |
| Red Hat | registry.redhat.io/openshift4/ose-ptp-rhel9@sha256:1cb7a5b4c0767341a5cdcb7153b9cd35950876dfb5c52f22045d74b9b024e771_ppc64le as a component of Red Hat OpenShift Container Platform 4.18 | *, registry.redhat.io/openshift4/ose-ptp-rhel9@sha256:1cb7a5b4c0767341a5cdcb7153b9cd35950876dfb5c52f22045d74b9b024e771_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel9-operator@sha256:3923459841eb6d2c7b2e21014918655c320f76dfa9eb790790cdbc640f6d90c4_ppc64le as a component of Red Hat OpenShift Container Platform 4.18 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel9@sha256:a4c710612b81e0a82a0592f2148ddaf49ce2398a5a3258fe0cec445dc0d6a1ce_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel9@sha256:a4c710612b81e0a82a0592f2148ddaf49ce2398a5a3258fe0cec445dc0d6a1ce_arm64, * |
| Red Hat | registry.redhat.io/openshift4/ose-operator-sdk-rhel9@sha256:f8edff8d9c17f9261c3f1a82bd3e3bdd9c0b7caf3522d1d279cd241ed4f381eb_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | *, registry.redhat.io/openshift4/ose-operator-sdk-rhel9@sha256:f8edff8d9c17f9261c3f1a82bd3e3bdd9c0b7caf3522d1d279cd241ed4f381eb_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-mustgather-rhel9@sha256:14b9f00e4c1d14e9a7acdf0e47f39c1f968e6667335791b130f382ad84860071_amd64 as a component of Red Hat OpenShift Container Platform 4.18 | registry.redhat.io/openshift4/ose-secrets-store-csi-mustgather-rhel9@sha256:14b9f00e4c1d14e9a7acdf0e47f39c1f968e6667335791b130f382ad84860071_amd64, * |
| Red Hat | registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:f6d73c2a71879ca8d10adeefcc812dc25504612653679bad83d6fa3a84c7ab8f_ppc64le as a component of Red Hat OpenShift Container Platform 4.18 | registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:f6d73c2a71879ca8d10adeefcc812dc25504612653679bad83d6fa3a84c7ab8f_ppc64le, * |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel9-operator@sha256:f605c7a3228a4fc822acc79e2ef3a649e7bb47916b46870148c7853720170330_ppc64le as a component of Red Hat OpenShift Container Platform 4.18 | *, registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel9-operator@sha256:f605c7a3228a4fc822acc79e2ef3a649e7bb47916b46870148c7853720170330_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-mustgather-rhel9@sha256:fc449b6e706f8c496422ca0326feace03a20b747f51bff26d89a2337576edea3_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | *, registry.redhat.io/openshift4/ose-secrets-store-csi-mustgather-rhel9@sha256:fc449b6e706f8c496422ca0326feace03a20b747f51bff26d89a2337576edea3_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:c73ad1be5e40a5d97bab0d7cfe4776a2758c72d7cf5fc208738235743a452850_arm64 as a component of Red Hat OpenShift Container Platform 4.18 | *, registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:c73ad1be5e40a5d97bab0d7cfe4776a2758c72d7cf5fc208738235743a452850_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-dpu-daemon-rhel9@sha256:42b0439df45d1961bd40d8dd61addf3cbf0e0f52edc3e3ab6e9f4e7a9d719e78_amd64 as a component of Red Hat OpenShift Container Platform 4.18 | *, registry.redhat.io/openshift4/ose-dpu-daemon-rhel9@sha256:42b0439df45d1961bd40d8dd61addf3cbf0e0f52edc3e3ab6e9f4e7a9d719e78_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-smb-csi-driver-rhel9@sha256:63643a3d51e0746e5f8ed8270284e7a6635893371d483d7a651564c73ebe30f2_s390x as a component of Red Hat OpenShift Container Platform 4.18 | registry.redhat.io/openshift4/ose-smb-csi-driver-rhel9@sha256:63643a3d51e0746e5f8ed8270284e7a6635893371d483d7a651564c73ebe30f2_s390x, * |
| Red Hat | registry.redhat.io/openshift4/ose-vertical-pod-autoscaler-rhel9@sha256:a509985955342f05ef619fc5721197a1f94a85531852ae55b71e2d61cd644e69_ppc64le as a component of Red Hat OpenShift Container Platform 4.18 | *, registry.redhat.io/openshift4/ose-vertical-pod-autoscaler-rhel9@sha256:a509985955342f05ef619fc5721197a1f94a85531852ae55b71e2d61cd644e69_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:1f94a039a294272c7905767bc74f4e0d693baee01be78d4da08961887f6c6f0a_ppc64le as a component of Red Hat OpenShift Container Platform 4.18 | registry.redhat.io/openshift4/ose-sriov-network-device-plugin-rhel9@sha256:1f94a039a294272c7905767bc74f4e0d693baee01be78d4da08961887f6c6f0a_ppc64le, * |
…and 171 more
Timeline
- Feb 11, 2026 CVE Published
- May 11, 2026 Distribution Patch
- May 11, 2026 Security Advisory
- May 11, 2026 Security Advisory
- May 13, 2026 CVE Updated
- May 15, 2026 Distribution Patch
References
- https://access.redhat.com/errata/RHSA-2026:2079 advisory
- https://www.cve.org/CVERecord?id=CVE-2025-65637 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-65637 advisory
- https://github.com/mjuanxd/logrus-dos-poc/blob/main/README.md exploit
- https://github.com/sirupsen/logrus/issues/1370 advisory
- https://github.com/sirupsen/logrus/releases/tag/v1.8.3 advisory
- https://github.com/sirupsen/logrus/releases/tag/v1.9.1 advisory
- https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSIRUPSENLOGRUS-5564391 advisory
- https://access.redhat.com/security/cve/CVE-2025-65637 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2079.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2418900 issue
- https://github.com/mjuanxd/logrus-dos-poc exploit
- https://github.com/sirupsen/logrus/pull/1376 advisory
- https://github.com/sirupsen/logrus/releases/tag/v1.9.3 advisory