A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.11.0-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2025-087 advisory.

    crypto/x509: excluded subdomain constraint does not restrict wildcard SANs

    An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in     the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not     prevent a leaf certificate from claiming the SAN *.example.com. (CVE-2025-61727)

    Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts     that will be printed out. Furthermore, the error string is constructed by repeated string concatenation,     leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in     excessive resource consumption. (CVE-2025-61729)

    A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a     single-line payload larger than 64KB without newline characters. Due to limitations in the internal     bufio.Scanner, the read fails with token too long and the writer pipe is closed, leaving Writer()     unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2.
    The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to     function even if an error is logged. (CVE-2025-65637)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.11.0-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2025-087 advisory.

    crypto/x509: excluded subdomain constraint does not restrict wildcard SANs

    An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in     the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not     prevent a leaf certificate from claiming the SAN *.example.com. (CVE-2025-61727)

    Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts     that will be printed out. Furthermore, the error string is constructed by repeated string concatenation,     leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in     excessive resource consumption. (CVE-2025-61729)

    A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a     single-line payload larger than 64KB without newline characters. Due to limitations in the internal     bufio.Scanner, the read fails with token too long and the writer pipe is closed, leaving Writer()     unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2.
    The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to     function even if an error is logged. (CVE-2025-65637)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.11.0-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2025-079 advisory.

    crypto/x509: excluded subdomain constraint does not restrict wildcard SANs

    An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in     the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not     prevent a leaf certificate from claiming the SAN *.example.com. (CVE-2025-61727)

    Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts     that will be printed out. Furthermore, the error string is constructed by repeated string concatenation,     leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in     excessive resource consumption. (CVE-2025-61729)

    A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a     single-line payload larger than 64KB without newline characters. Due to limitations in the internal     bufio.Scanner, the read fails with token too long and the writer pipe is closed, leaving Writer()     unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2.
    The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to     function even if an error is logged. (CVE-2025-65637)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ecs-init installed on the remote host is prior to 1.82.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2025-092 advisory.

    A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a     single-line payload larger than 64KB without newline characters. Due to limitations in the internal     bufio.Scanner, the read fails with token too long and the writer pipe is closed, leaving Writer()     unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2.
    The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to     function even if an error is logged. (CVE-2025-65637)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a     single-line payload larger than 64KB without newline characters. Due to limitations in the internal     bufio.Scanner, the read fails with token too long and the writer pipe is closed, leaving Writer()     unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2.
    The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to     function even if an error is logged. (CVE-2025-65637)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
281821	Amazon Linux 2 : amazon-ecr-credential-helper, --advisory ALAS2DOCKER-2025-087 (ALASDOCKER-2025-087)	Nessus	Amazon Linux Local Security Checks	high
281810	Amazon Linux 2 : amazon-ecr-credential-helper, --advisory ALAS2ECS-2025-087 (ALASECS-2025-087)	Nessus	Amazon Linux Local Security Checks	high
281793	Amazon Linux 2 : amazon-ecr-credential-helper, --advisory ALAS2NITRO-ENCLAVES-2025-079 (ALASNITRO-ENCLAVES-2025-079)	Nessus	Amazon Linux Local Security Checks	high
281774	Amazon Linux 2 : ecs-init, --advisory ALAS2ECS-2025-092 (ALASECS-2025-092)	Nessus	Amazon Linux Local Security Checks	high
277513	Linux Distros Unpatched Vulnerability : CVE-2025-65637	Nessus	Misc.	high

Detections

Analytics

CVE-2025-65637

high

Tenable Plugins

high

high

high

high

high