Resource exhaustion in logrus - CVE-2025-65637

Vulnerability identifier: #VU121565

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-65637

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

logrus
Financial Transaction Manager for RedHat OpenShift
Red Hat OpenShift Container Platform
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Anolis OS
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
openEuler
Fedora
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
toolbox (Red Hat package)
toolbox-tests
toolbox
udica
docker-runc
skopeo-debugsource
skopeo-debuginfo
containers-common
skopeo
fvwm3
runc
slirp4netns
runc (Red Hat package)
oci-seccomp-bpf-hook
oci-seccomp-bpf-hook (Red Hat package)
containernetworking-plugins
skopeo (Red Hat package)
aardvark-dns
netavark
kata-containers-go
fuse-overlayfs
crun (Red Hat package)
crun
skopeo-tests
cri-tools-debugsource
cri-tools-debuginfo
cri-tools
cri-o (Red Hat package)
buildah (Red Hat package)
buildah
buildah-tests
conmon
container-selinux
python3-criu
criu-devel
criu-libs
criu
crit
libslirp
libslirp-devel
podman (Red Hat package)
python3-podman
podman-docker
podman-tests
podman
podman-catatonit
podman-gvproxy
podman-plugins
podman-remote
openshift (Red Hat package)
microshift (Red Hat package)
kernel (Red Hat package)
kernel-rt (Red Hat package)
osbuild-composer (Red Hat package)
cockpit-podman
Red Hat build of MicroShift

Install updates from vendor's website.

logrus - addressed in versions 1.8.3, 1.9.1, 1.9.3
Red Hat OpenShift Container Platform - addressed in versions 4.12.88, 4.13.65, 4.15.62, 4.16.55, 4.16.57, 4.17.47, 4.18.31
toolbox (Red Hat package) - addressed in versions 0.0.99.4.1-1.el9_2, 0.0.99.5.1-2.el9_4
toolbox-tests - update to 0.0.99.5.1-1.0.1
toolbox - update to 0.0.99.5.1-1.0.1
udica - update to 0.2.6-21
docker-runc - update to 1.0.0 rc3-230
skopeo-debugsource - addressed in versions 1.1.0-16, 1.8.0-10
skopeo-debuginfo - addressed in versions 1.1.0-16, 1.8.0-10
containers-common - update to 1.1.0-16
skopeo - addressed in versions 1.1.0-16, 1.8.0-10
fvwm3 - addressed in versions 1.1.4-4.fc42, 1.1.4-4.fc43
runc - addressed in versions 1.1.8-28, 1.1.8-29
slirp4netns - update to 1.2.3-1
runc (Red Hat package) - addressed in versions 1.2.9-1.el9_0, 1.2.9-1.el9_2.1
runc - update to 1.2.9-3
oci-seccomp-bpf-hook - update to 1.2.10-1
oci-seccomp-bpf-hook (Red Hat package) - addressed in versions 1.2.10-1.el9_0, 1.2.10-1.el9_2
containernetworking-plugins - update to 1.4.0-7.0.1
skopeo (Red Hat package) - addressed in versions 1.8.0-4.1.el9_0.3, 1.11.3-7.rhaos4.15.el8, 1.11.3-8.rhaos4.15.el9, 1.11.4-0.1.el9_2.5
aardvark-dns - update to 1.10.1-2.0.1
netavark - update to 1.10.3-1.0.1
kata-containers-go - update to 1.11.1-33
fuse-overlayfs - update to 1.13-1.0.1
crun (Red Hat package) - update to 1.14.3-1.el9_0
crun - update to 1.14.3-2
skopeo-tests - update to 1.14.5-6
skopeo - update to 1.14.5-6
cri-tools-debugsource - update to 1.22.0-9
cri-tools-debuginfo - update to 1.22.0-9
cri-tools - update to 1.22.0-9
cri-o (Red Hat package) - update to 1.28.11-13.rhaos4.15.gitf722b2f.el9
buildah (Red Hat package) - update to 1.29.5-1.el9_2.2
buildah - update to 1.33.14-2
buildah-tests - update to 1.33.14-2
containers-common - update to 1-82.0.1
conmon - update to 2.1.10-1
container-selinux - update to 2.229.0-2
python3-criu - update to 3.18-5.0.1
criu-devel - update to 3.18-5.0.1
criu-libs - update to 3.18-5.0.1
criu - update to 3.18-5.0.1
crit - update to 3.18-5.0.1
libslirp - update to 4.4.0-2
libslirp-devel - update to 4.4.0-2
podman (Red Hat package) - addressed in versions 4.4.1-22.el9_2.5, 4.4.1-36.rhaos4.15.el8, 4.4.1-36.rhaos4.15.el9
python3-podman - update to 4.9.0-3
podman-docker - update to 4.9.4-28.0.1
podman-tests - update to 4.9.4-28.0.1
podman - update to 4.9.4-28.0.1
podman-catatonit - update to 4.9.4-28.0.1
podman-gvproxy - update to 4.9.4-28.0.1
podman-plugins - update to 4.9.4-28.0.1
podman-remote - update to 4.9.4-28.0.1
openshift (Red Hat package) - addressed in versions 4.12.0-202604271501.p2.gedc7ba9.assembly.stream.el8, 4.12.0-202604271501.p2.gedc7ba9.assembly.stream.el9, 4.13.0-202603240119.p2.g7aa9360.assembly.stream.el8, 4.13.0-202603240119.p2.g7aa9360.assembly.stream.el9, 4.15.0-202602130120.p2.g5cb2ef4.assembly.stream.el8, 4.15.0-202602130120.p2.g5cb2ef4.assembly.stream.el9, 4.16.0-202602100409.p2.g41c4e9b.assembly.stream.el8, 4.16.0-202602100409.p2.g41c4e9b.assembly.stream.el9
Red Hat build of MicroShift - addressed in versions 4.16.58, 4.17.49
microshift (Red Hat package) - addressed in versions 4.16.58-202603160404.p0.gb9661ec.assembly.4.16.58.el9, 4.17.49-202602161401.p0.g708a69a.assembly.4.17.49.el9
kernel (Red Hat package) - addressed in versions 4.18.0-372.190.1.el8_6, 5.14.0-284.161.1.el9_2, 5.14.0-284.165.1.el9_2
kernel-rt (Red Hat package) - addressed in versions 5.14.0-284.161.1.rt14.446.el9_2, 5.14.0-284.165.1.rt14.450.el9_2
osbuild-composer (Red Hat package) - addressed in versions 46.3-5.el8_6, 46.3-6.el9_0, 75-6.el8_8, 76.1-4.el9_2
cockpit-podman - update to 84.1-1

• https://github.com/mjuanxd/logrus-dos-poc
• https://github.com/mjuanxd/logrus-dos-poc/blob/main/README.md
• https://github.com/sirupsen/logrus/issues/1370
• https://github.com/sirupsen/logrus/pull/1376
• https://github.com/sirupsen/logrus/releases/tag/v1.8.3
• https://github.com/sirupsen/logrus/releases/tag/v1.9.1
• https://github.com/sirupsen/logrus/releases/tag/v1.9.3
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSIRUPSENLOGRUS-5564391

• Denial of service in logrus
• OpenShift Container Platform 4.18 update for logrus
• OpenShift Container Platform 4.16 update for logrus
• openEuler 24.03 LTS SP1 update for runc
• openEuler 20.03 LTS SP4 update for runc
• openEuler 24.03 LTS SP2 update for runc
• openEuler 24.03 LTS update for runc
• Multiple vulnerabilities in IBM Financial Transaction Manager (FTM) for RedHat OpenShift
• Fedora 43 update for fvwm3
• Fedora 42 update for fvwm3
• Red Hat Enterprise Linux 9 update for toolbox
• Red Hat Enterprise Linux 9 update for toolbox
• Red Hat Enterprise Linux 8 update for osbuild-composer
• Red Hat Enterprise Linux 9 update for osbuild-composer
• Red Hat Enterprise Linux 8 update for osbuild-composer
• Red Hat Enterprise Linux 9 update for osbuild-composer
• OpenShift Container Platform 4.17 update for logrus
• Resource exhaustion in Red Hat OpenShift Container Platform 4.16 packages
• Resource exhaustion in Red Hat build of MicroShift 4.17 packages
• Red Hat Enterprise Linux 8 update for the container-tools:rhel8 module
• Anolis OS update for container-tools:an8 module
• Red Hat Enterprise Linux 9 update for runc
• Red Hat Enterprise Linux 9 update for buildah
• Red Hat Enterprise Linux 9 update for podman
• Red Hat Enterprise Linux 8 update for the container-tools:rhel8 module
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15 packages
• Resource exhaustion in Red Hat build of MicroShift 4.16 packages
• Red Hat Enterprise Linux 9 update for multiple packages
• Resource exhaustion in Red Hat OpenShift Container Platform 4.13 packages
• Red Hat Enterprise Linux 9 update for oci-seccomp-bpf-hook
• Red Hat Enterprise Linux 9 update for skopeo
• Resource exhaustion in Red Hat OpenShift Container Platform 4.12 packages
• Red Hat Enterprise Linux 9 update for oci-seccomp-bpf-hook
• Red Hat Enterprise Linux 9 update for skopeo
• openEuler 24.03 LTS SP3 update for kata-containers-go
• openEuler 22.03 LTS SP4 update for cri-tools
• openEuler 22.03 LTS SP4 update for skopeo
• openEuler 20.03 LTS SP4 update for skopeo