VDB
RHSA-2026:2130
RHSA-2026:2130
PUBLISHED
CVSS 7.5 HIGH
A denial-of-service vulnerability in github.com/sirupsen/logrus occurs when Entry.Writer() processes a single-line payload larger than 64KB with no newline characters. Due to a limitation in Go’s internal bufio.Scanner, the read operation fails with a “token too long” error, causing the underlying writer pipe to close. In affected versions, this leaves the Writer interface unusable and can disrupt logging functionality, potentially degrading application availability.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-dpu-daemon-rhel9@sha256:80221b1ef2c9a065b46cbc2c2f243425ea64f5b85fb257b16992641262da4542_ppc64le as a component of Red Hat OpenShift Container Platform 4.21 | registry.redhat.io/openshift4/ose-dpu-daemon-rhel9@sha256:80221b1ef2c9a065b46cbc2c2f243425ea64f5b85fb257b16992641262da4542_ppc64le, * |
| Red Hat | registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:385fb231057674e201745b8e8ca0abcd88b1a9032bf7a00ea30f45b83c085fb3_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | *, registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:385fb231057674e201745b8e8ca0abcd88b1a9032bf7a00ea30f45b83c085fb3_arm64 |
| Red Hat | registry.redhat.io/openshift4/metallb-rhel9@sha256:6954268e20cfe496851cf51000d80e20fad3600d2e75a4f10118f2cc2d9df4d0_ppc64le as a component of Red Hat OpenShift Container Platform 4.21 | *, registry.redhat.io/openshift4/metallb-rhel9@sha256:6954268e20cfe496851cf51000d80e20fad3600d2e75a4f10118f2cc2d9df4d0_ppc64le |
| Red Hat | registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:9f45ed432f0c62af0ed5fcfc3152b2ef26881b8d1fb628e3ea770461810230f3_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | *, registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:9f45ed432f0c62af0ed5fcfc3152b2ef26881b8d1fb628e3ea770461810230f3_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel9-operator@sha256:0da98ae7ba96fa5e688186af9e12ae664a0626045e1721756e2f9ffabae3ba21_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel9-operator@sha256:0da98ae7ba96fa5e688186af9e12ae664a0626045e1721756e2f9ffabae3ba21_arm64, * |
| Red Hat | registry.redhat.io/openshift4/ose-dpu-intel-netsec-vsp-rhel9@sha256:06c8eb4744cfb661df74c94624408d110f81b6d693f0ead0c0a3d34b6798f6f8_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | registry.redhat.io/openshift4/ose-dpu-intel-netsec-vsp-rhel9@sha256:06c8eb4744cfb661df74c94624408d110f81b6d693f0ead0c0a3d34b6798f6f8_arm64, * |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-mustgather-rhel9@sha256:eb1e2440809fd55615cf5872a780daf29f057bb6ec7ff5c36198efa381b661f8_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | registry.redhat.io/openshift4/ose-secrets-store-csi-mustgather-rhel9@sha256:eb1e2440809fd55615cf5872a780daf29f057bb6ec7ff5c36198efa381b661f8_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-ptp-rhel9@sha256:3117f5476cfd6ad3642abe9251f5f95306f729022456c77d83e9ea335367ddb7_ppc64le as a component of Red Hat OpenShift Container Platform 4.21 | *, registry.redhat.io/openshift4/ose-ptp-rhel9@sha256:3117f5476cfd6ad3642abe9251f5f95306f729022456c77d83e9ea335367ddb7_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-vertical-pod-autoscaler-rhel9@sha256:2174b0228336b2c17ad945842a77b5ef8fb2491f3d74495e1de0b1f0417719c5_ppc64le as a component of Red Hat OpenShift Container Platform 4.21 | *, registry.redhat.io/openshift4/ose-vertical-pod-autoscaler-rhel9@sha256:2174b0228336b2c17ad945842a77b5ef8fb2491f3d74495e1de0b1f0417719c5_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-capacity-rhel9@sha256:a17dcf79bbc3257e3ba70c6db7008db032ee61855dc4f28f28679ac3b926ae2d_ppc64le as a component of Red Hat OpenShift Container Platform 4.21 | *, * |
| Red Hat | registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:3fd9d8be86110614bc815287969776a07e21597e91ac3f1f98cc9a007d84bffd_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | *, registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:3fd9d8be86110614bc815287969776a07e21597e91ac3f1f98cc9a007d84bffd_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-local-storage-rhel9-operator@sha256:23811c9798b256bdb0dbd09f541e761d07efae1979f82022967de5bed579aa5b_s390x as a component of Red Hat OpenShift Container Platform 4.21 | registry.redhat.io/openshift4/ose-local-storage-rhel9-operator@sha256:23811c9798b256bdb0dbd09f541e761d07efae1979f82022967de5bed579aa5b_s390x, * |
| Red Hat | registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:d1325789df0014829305dea0861e33f43703a0f475125f0187bec66c03a8cdc8_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:d1325789df0014829305dea0861e33f43703a0f475125f0187bec66c03a8cdc8_arm64, * |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-mustgather-rhel9@sha256:9abe6c91ea4638c701960e601b688e59d0692167b429baa32ca334c97f9e25b9_s390x as a component of Red Hat OpenShift Container Platform 4.21 | *, registry.redhat.io/openshift4/ose-secrets-store-csi-mustgather-rhel9@sha256:9abe6c91ea4638c701960e601b688e59d0692167b429baa32ca334c97f9e25b9_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-capacity-rhel9@sha256:7a6f66cd61dbe90df4dcf50995f7376b2410b05e174adb87e80023b0fd5ace31_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | *, registry.redhat.io/openshift4/ose-cluster-capacity-rhel9@sha256:7a6f66cd61dbe90df4dcf50995f7376b2410b05e174adb87e80023b0fd5ace31_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-cloud-event-proxy-rhel9@sha256:ea23d94014d5a27d0a4651af441f6809d635d85bfc53e423bc698e9b5e82bd71_ppc64le as a component of Red Hat OpenShift Container Platform 4.21 | *, registry.redhat.io/openshift4/ose-cloud-event-proxy-rhel9@sha256:ea23d94014d5a27d0a4651af441f6809d635d85bfc53e423bc698e9b5e82bd71_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-dpu-marvell-cp-agent-rhel9@sha256:69a990ac0b21c3e280aae323e8b8869a1c8e26e4f68a4da9debcea5e7ec5d43b_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | *, registry.redhat.io/openshift4/ose-dpu-marvell-cp-agent-rhel9@sha256:69a990ac0b21c3e280aae323e8b8869a1c8e26e4f68a4da9debcea5e7ec5d43b_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-dpu-marvell-vsp-rhel9@sha256:ffe7ff75cd3c30921068b68b5e301a6179334b51ad2a5a68cf7f7c200f6b7e43_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | registry.redhat.io/openshift4/ose-dpu-marvell-vsp-rhel9@sha256:ffe7ff75cd3c30921068b68b5e301a6179334b51ad2a5a68cf7f7c200f6b7e43_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-driver-rhel9-operator@sha256:1944571e8f14cc5fce253053d399c699683b8b24694e40dee54fba3ad8bddc35_s390x as a component of Red Hat OpenShift Container Platform 4.21 | *, * |
| Red Hat | registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:02d588dc99c7c445abbabc6b2d77d2a1e637f1b2b98a44ad7ef86940049ea15e_s390x as a component of Red Hat OpenShift Container Platform 4.21 | registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:02d588dc99c7c445abbabc6b2d77d2a1e637f1b2b98a44ad7ef86940049ea15e_s390x, * |
…and 165 more
Timeline
- Feb 10, 2026 CVE Published
- May 11, 2026 Distribution Patch
- May 11, 2026 Distribution Patch
- May 11, 2026 Security Advisory
- May 13, 2026 CVE Updated
- May 15, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:2130 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2130.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2418900 issue
- https://www.cve.org/CVERecord?id=CVE-2025-65637 advisory
- https://github.com/mjuanxd/logrus-dos-poc exploit
- https://github.com/sirupsen/logrus/pull/1376 advisory
- https://github.com/sirupsen/logrus/releases/tag/v1.8.3 advisory
- https://github.com/sirupsen/logrus/releases/tag/v1.9.1 advisory
- https://github.com/sirupsen/logrus/releases/tag/v1.9.3 advisory
- https://access.redhat.com/security/cve/CVE-2025-65637 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-65637 advisory
- https://github.com/mjuanxd/logrus-dos-poc/blob/main/README.md exploit
- https://github.com/sirupsen/logrus/issues/1370 advisory
- https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSIRUPSENLOGRUS-5564391 advisory