VDB
RHSA-2026:2652
RHSA-2026:2652
PUBLISHED
CVSS 7.5 HIGH
A denial-of-service vulnerability in github.com/sirupsen/logrus occurs when Entry.Writer() processes a single-line payload larger than 64KB with no newline characters. Due to a limitation in Go’s internal bufio.Scanner, the read operation fails with a “token too long” error, causing the underlying writer pipe to close. In affected versions, this leaves the Writer interface unusable and can disrupt logging functionality, potentially degrading application availability.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-cluster-capacity-rhel9@sha256:5ad3dfb38e954fd3ac298719f82a93be1c86c3f4a64d8c513d9378ed8053fe1c_s390x as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-dpu-rhel9-operator@sha256:d35c5a1e0e85fa13459e9d19e4017e633b1603743c31e2dd4ae9a5826935bec9_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | *, registry.redhat.io/openshift4/ose-dpu-rhel9-operator@sha256:d35c5a1e0e85fa13459e9d19e4017e633b1603743c31e2dd4ae9a5826935bec9_ppc64le |
| Red Hat | registry.redhat.io/openshift4/ose-vertical-pod-autoscaler-rhel9@sha256:802f5b026f8b94b4a6271ea9341eb5750b85367bbf3c94d66f31b16381252974_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | registry.redhat.io/openshift4/ose-vertical-pod-autoscaler-rhel9@sha256:802f5b026f8b94b4a6271ea9341eb5750b85367bbf3c94d66f31b16381252974_arm64, * |
| Red Hat | registry.redhat.io/openshift4/ose-ansible-rhel9-operator@sha256:211015497429e1c807c8f202dc7ebdcd1a43d1d820809d31eb6dfd85608ae0b5_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | *, registry.redhat.io/openshift4/ose-ansible-rhel9-operator@sha256:211015497429e1c807c8f202dc7ebdcd1a43d1d820809d31eb6dfd85608ae0b5_arm64 |
| Red Hat | registry.redhat.io/openshift4/pf-status-relay-rhel9-operator@sha256:a806b5871fb1612f2d07168d1ac21fd8c365623fb7460dd53fa4fc3fe05e510d_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | registry.redhat.io/openshift4/pf-status-relay-rhel9-operator@sha256:a806b5871fb1612f2d07168d1ac21fd8c365623fb7460dd53fa4fc3fe05e510d_ppc64le, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-nfd-rhel9-operator@sha256:52e7c1e64bd09691dc65811e9771a9a74a7202cecb020184312ce1ff4d8c006c_s390x as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:56ac4169af6f76852f1597f32de044929bb53d45b462d2c5ace3ed555e0cf7f3_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | registry.redhat.io/openshift4/ose-sriov-network-metrics-exporter-rhel9@sha256:56ac4169af6f76852f1597f32de044929bb53d45b462d2c5ace3ed555e0cf7f3_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-dpu-daemon-rhel9@sha256:a6abebfa933aaea5e3d4668b9ce3998a68882dd125b0bbf238684bfd6b847eac_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-driver-rhel9-operator@sha256:6c432d3603440ea310ede5382298a221c1a3d8d6a3888995ed7053af4f1640db_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | registry.redhat.io/openshift4/ose-secrets-store-csi-driver-rhel9-operator@sha256:6c432d3603440ea310ede5382298a221c1a3d8d6a3888995ed7053af4f1640db_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:a1c8ae3b2155f9b5f8431b742ec720ddd22bcbcf3f639d22789b9455ab80dcf3_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-nfd-rhel9-operator@sha256:7711115036a9d920e9a709990947bb7e8ce8e61e9bd6517bdcf87db511de463a_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | registry.redhat.io/openshift4/ose-cluster-nfd-rhel9-operator@sha256:7711115036a9d920e9a709990947bb7e8ce8e61e9bd6517bdcf87db511de463a_ppc64le, * |
| Red Hat | registry.redhat.io/openshift4/ose-ansible-rhel9-operator@sha256:c3c00a96422d99a2a134b1ffd5b7672865a139fe8351588a4c487877d4748b1b_s390x as a component of Red Hat OpenShift Container Platform 4.19 | *, registry.redhat.io/openshift4/ose-ansible-rhel9-operator@sha256:c3c00a96422d99a2a134b1ffd5b7672865a139fe8351588a4c487877d4748b1b_s390x |
| Red Hat | registry.redhat.io/openshift4/ose-secrets-store-csi-mustgather-rhel9@sha256:5678dfaaeb6eb23d1ef27121109435cc9d54b743b6796345418a70614cbc15e2_s390x as a component of Red Hat OpenShift Container Platform 4.19 | registry.redhat.io/openshift4/ose-secrets-store-csi-mustgather-rhel9@sha256:5678dfaaeb6eb23d1ef27121109435cc9d54b743b6796345418a70614cbc15e2_s390x, * |
| Red Hat | registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:ed4c73faa126dcfd70e9898a964a6e40721901cd76b5571fbaa4fa4cd8981675_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | *, registry.redhat.io/openshift4/sriov-cni-rhel9@sha256:ed4c73faa126dcfd70e9898a964a6e40721901cd76b5571fbaa4fa4cd8981675_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9@sha256:66f730ea8a021311918219e229c4fab3d3902298b151342d2dc2a4fcbe1d1afc_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | *, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9@sha256:66f730ea8a021311918219e229c4fab3d3902298b151342d2dc2a4fcbe1d1afc_arm64 |
| Red Hat | registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel9@sha256:67fcfaa07a3ce93635398ecf1441af8fd84b209cffb3861c205fd4cb51dad952_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel9@sha256:67fcfaa07a3ce93635398ecf1441af8fd84b209cffb3861c205fd4cb51dad952_ppc64le, * |
| Red Hat | registry.redhat.io/openshift4/ose-vertical-pod-autoscaler-rhel9@sha256:6a42d7e52e44956d4add10a2e0f25083d580f9578c3c22079266aab4e4b95d12_s390x as a component of Red Hat OpenShift Container Platform 4.19 | *, registry.redhat.io/openshift4/ose-vertical-pod-autoscaler-rhel9@sha256:6a42d7e52e44956d4add10a2e0f25083d580f9578c3c22079266aab4e4b95d12_s390x |
| Red Hat | registry.redhat.io/openshift4/metallb-rhel9@sha256:c856962f52c94d55520577fab3b489a3f374138358141156ddce5d05bb80f51c_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | registry.redhat.io/openshift4/metallb-rhel9@sha256:c856962f52c94d55520577fab3b489a3f374138358141156ddce5d05bb80f51c_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:cd3de96f697daa75763260d56afb609339872c3681871ae229dd1c283d432738_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:cd3de96f697daa75763260d56afb609339872c3681871ae229dd1c283d432738_ppc64le, * |
| Red Hat | registry.redhat.io/openshift4/ose-dpu-rhel9-operator@sha256:457773c70a1f18b21e81fae78cd1838def3232eee99dd2eedbfcc6627236fc14_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | registry.redhat.io/openshift4/ose-dpu-rhel9-operator@sha256:457773c70a1f18b21e81fae78cd1838def3232eee99dd2eedbfcc6627236fc14_arm64, * |
…and 165 more
Timeline
- Feb 17, 2026 CVE Published
- May 11, 2026 Distribution Patch
- May 11, 2026 Security Advisory
- May 13, 2026 CVE Updated
- May 15, 2026 Distribution Patch
- May 15, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:2652 advisory
- https://access.redhat.com/security/cve/CVE-2025-65637 advisory
- https://www.cve.org/CVERecord?id=CVE-2025-65637 advisory
- https://github.com/mjuanxd/logrus-dos-poc/blob/main/README.md exploit
- https://github.com/sirupsen/logrus/issues/1370 advisory
- https://github.com/sirupsen/logrus/pull/1376 advisory
- https://github.com/sirupsen/logrus/releases/tag/v1.9.1 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2652.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2418900 issue
- https://nvd.nist.gov/vuln/detail/CVE-2025-65637 advisory
- https://github.com/mjuanxd/logrus-dos-poc exploit
- https://github.com/sirupsen/logrus/releases/tag/v1.8.3 advisory
- https://github.com/sirupsen/logrus/releases/tag/v1.9.3 advisory
- https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSIRUPSENLOGRUS-5564391 advisory