A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.8.3, 1.9.1, 1.9.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- n/a n/a
Version range not reported
- github.com/sirupsen/logrusGo
fixed in 1.8.3
- github.com/sirupsen/logrusGo
From 1.9.0 · fixed in 1.9.1
- github.com/sirupsen/logrusGo
From 1.9.2 · fixed in 1.9.3
- github.com/sirupsen/logrusGo
fixed in 1.8.3; From 1.9.0 · fixed in 1.9.1; From 1.9.2 · fixed in 1.9.3