---
title: "CVE-2025-65637\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2025-65637?format=md
keywords: index, follow
---

# CVE-2025-65637

Publication date 4 December 2025

Last updated 10 December 2025

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**7.5 · High**

[Score breakdown](https://ubuntu.com/security/CVE-2025-65637?format=md#impact-score)

Toggle side navigation

## Description

A denial-of-service vulnerability exists in github.com/sirupsen/logrus when
using Entry.Writer() to log a single-line payload larger than 64KB without
newline characters. Due to limitations in the internal bufio.Scanner, the
read fails with "token too long" and the writer pipe is closed, leaving
Writer() unusable and causing application unavailability (DoS). This
affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3,
1.9.1, and 1.9.3+, where the input is chunked and the writer continues to
function even if an error is logged.

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| golang-logrus | 26.04 LTS resolute | Needs evaluation |
| 25.10 questing | Ignored end of life, was needs-triage |
| 25.04 plucky | Ignored end of life, was needs-triage |
| 24.04 LTS noble | Needs evaluation |
| 22.04 LTS jammy | Needs evaluation |
| 20.04 LTS focal | Needs evaluation |
| 18.04 LTS bionic | Needs evaluation |
| 16.04 LTS xenial | Needs evaluation |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

7.5 · High

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | Low |
  | Privileges required | None |
  | User interaction | None |
  | Scope | Unchanged |
  | Confidentiality impact | None |
  | Integrity impact | None |
  | Availability impact | High |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 7.5 · High |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-65637)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-65637)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2025-65637)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2025-65637)

### Other references

* <https://www.cve.org/CVERecord?id=CVE-2025-65637>
* <https://github.com/mjuanxd/logrus-dos-poc>
* <https://github.com/sirupsen/logrus/issues/1370>
* <https://github.com/sirupsen/logrus/pull/1384>
* <https://github.com/sirupsen/logrus/pull/1376>
* <https://github.com/mjuanxd/logrus-dos-poc/blob/main/README.md>
* <https://github.com/sirupsen/logrus/releases/tag/v1.8.3>
* <https://github.com/sirupsen/logrus/releases/tag/v1.9.1>
* <https://github.com/sirupsen/logrus/releases/tag/v1.9.3>
* <https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSIRUPSENLOGRUS-5564391>