A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.

The version of CBL-Mariner Releases installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-65637 advisory.

  - A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a     single-line payload larger than 64KB without newline characters. Due to limitations in the internal     bufio.Scanner, the read fails with token too long and the writer pipe is closed, leaving Writer()     unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2.
    The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to     function even if an error is logged. (CVE-2025-65637)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-65637 advisory.

  - A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a     single-line payload larger than 64KB without newline characters. Due to limitations in the internal     bufio.Scanner, the read fails with token too long and the writer pipe is closed, leaving Writer()     unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2.
    The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to     function even if an error is logged. (CVE-2025-65637)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of docker installed on the remote host is prior to 25.0.14-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-095 advisory.

    Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts     that will be printed out. Furthermore, the error string is constructed by repeated string concatenation,     leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in     excessive resource consumption. (CVE-2025-61729)

    A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a     single-line payload larger than 64KB without newline characters. Due to limitations in the internal     bufio.Scanner, the read fails with token too long and the writer pipe is closed, leaving Writer()     unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2.
    The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to     function even if an error is logged. (CVE-2025-65637)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of docker installed on the remote host is prior to 25.0.14-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-094 advisory.

    SSH Agent servers do not validate the size of messages when processing new identity requests, which may     cause the program to panic if the message is malformed due to an out of bounds read. (CVE-2025-47914)

    SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in     the request, allowing an attacker to cause unbounded memory consumption. (CVE-2025-58181)

    crypto/x509: excluded subdomain constraint does not restrict wildcard SANs

    An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in     the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not     prevent a leaf certificate from claiming the SAN *.example.com. (CVE-2025-61727)

    Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts     that will be printed out. Furthermore, the error string is constructed by repeated string concatenation,     leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in     excessive resource consumption. (CVE-2025-61729)

    A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a     single-line payload larger than 64KB without newline characters. Due to limitations in the internal     bufio.Scanner, the read fails with token too long and the writer pipe is closed, leaving Writer()     unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2.
    The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to     function even if an error is logged. (CVE-2025-65637)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of docker installed on the remote host is prior to 25.0.14-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-085 advisory.

    Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts     that will be printed out. Furthermore, the error string is constructed by repeated string concatenation,     leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in     excessive resource consumption. (CVE-2025-61729)

    A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a     single-line payload larger than 64KB without newline characters. Due to limitations in the internal     bufio.Scanner, the read fails with token too long and the writer pipe is closed, leaving Writer()     unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2.
    The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to     function even if an error is logged. (CVE-2025-65637)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:0425 advisory.

    The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides     container runtime.

    Security Fix(es):

    * runc: container escape via 'masked path' abuse due to mount race conditions (CVE-2025-31133)

    * runc: container escape with malicious config due to /dev/console mount and related races     (CVE-2025-52565)

    * runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects     (CVE-2025-52881)

    * github.com/sirupsen/logrus: github.com/sirupsen/logrus: Denial-of-Service due to large single-line     payload (CVE-2025-65637)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1327 advisory.

    crypto/x509: excluded subdomain constraint does not restrict wildcard SANs

    An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in     the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not     prevent a leaf certificate from claiming the SAN *.example.com. (CVE-2025-61727)

    Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts     that will be printed out. Furthermore, the error string is constructed by repeated string concatenation,     leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in     excessive resource consumption. (CVE-2025-61729)

    A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a     single-line payload larger than 64KB without newline characters. Due to limitations in the internal     bufio.Scanner, the read fails with token too long and the writer pipe is closed, leaving Writer()     unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2.
    The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to     function even if an error is logged. (CVE-2025-65637)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1345 advisory.

    A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a     single-line payload larger than 64KB without newline characters. Due to limitations in the internal     bufio.Scanner, the read fails with token too long and the writer pipe is closed, leaving Writer()     unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2.
    The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to     function even if an error is logged. (CVE-2025-65637)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.11.0-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2025-087 advisory.

    crypto/x509: excluded subdomain constraint does not restrict wildcard SANs

    An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in     the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not     prevent a leaf certificate from claiming the SAN *.example.com. (CVE-2025-61727)

    Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts     that will be printed out. Furthermore, the error string is constructed by repeated string concatenation,     leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in     excessive resource consumption. (CVE-2025-61729)

    A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a     single-line payload larger than 64KB without newline characters. Due to limitations in the internal     bufio.Scanner, the read fails with token too long and the writer pipe is closed, leaving Writer()     unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2.
    The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to     function even if an error is logged. (CVE-2025-65637)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.11.0-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2025-087 advisory.

    crypto/x509: excluded subdomain constraint does not restrict wildcard SANs

    An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in     the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not     prevent a leaf certificate from claiming the SAN *.example.com. (CVE-2025-61727)

    Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts     that will be printed out. Furthermore, the error string is constructed by repeated string concatenation,     leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in     excessive resource consumption. (CVE-2025-61729)

    A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a     single-line payload larger than 64KB without newline characters. Due to limitations in the internal     bufio.Scanner, the read fails with token too long and the writer pipe is closed, leaving Writer()     unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2.
    The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to     function even if an error is logged. (CVE-2025-65637)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.11.0-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2025-079 advisory.

    crypto/x509: excluded subdomain constraint does not restrict wildcard SANs

    An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in     the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not     prevent a leaf certificate from claiming the SAN *.example.com. (CVE-2025-61727)

    Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts     that will be printed out. Furthermore, the error string is constructed by repeated string concatenation,     leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in     excessive resource consumption. (CVE-2025-61729)

    A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a     single-line payload larger than 64KB without newline characters. Due to limitations in the internal     bufio.Scanner, the read fails with token too long and the writer pipe is closed, leaving Writer()     unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2.
    The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to     function even if an error is logged. (CVE-2025-65637)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ecs-init installed on the remote host is prior to 1.82.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2025-092 advisory.

    A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a     single-line payload larger than 64KB without newline characters. Due to limitations in the internal     bufio.Scanner, the read fails with token too long and the writer pipe is closed, leaving Writer()     unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2.
    The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to     function even if an error is logged. (CVE-2025-65637)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a     single-line payload larger than 64KB without newline characters. Due to limitations in the internal     bufio.Scanner, the read fails with token too long and the writer pipe is closed, leaving Writer()     unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2.
    The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to     function even if an error is logged. (CVE-2025-65637)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
295017	CBL Mariner 2.0 Security Update: CBL-Mariner Releases (CVE-2025-65637)	Nessus	MarinerOS Local Security Checks	high
295009	Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2025-65637)	Nessus	Azure Linux Local Security Checks	high
294909	Amazon Linux 2 : docker, --advisory ALAS2DOCKER-2026-095 (ALASDOCKER-2026-095)	Nessus	Amazon Linux Local Security Checks	high
294908	Amazon Linux 2 : docker, --advisory ALAS2ECS-2026-094 (ALASECS-2026-094)	Nessus	Amazon Linux Local Security Checks	high
294907	Amazon Linux 2 : docker, --advisory ALAS2NITRO-ENCLAVES-2026-085 (ALASNITRO-ENCLAVES-2026-085)	Nessus	Amazon Linux Local Security Checks	high
283519	RHEL 9 : runc (RHSA-2026:0425)	Nessus	Red Hat Local Security Checks	high
282388	Amazon Linux 2023 : amazon-ecr-credential-helper (ALAS2023-2025-1327)	Nessus	Amazon Linux Local Security Checks	high
282384	Amazon Linux 2023 : ecs-init (ALAS2023-2025-1345)	Nessus	Amazon Linux Local Security Checks	high
281821	Amazon Linux 2 : amazon-ecr-credential-helper, --advisory ALAS2DOCKER-2025-087 (ALASDOCKER-2025-087)	Nessus	Amazon Linux Local Security Checks	high
281810	Amazon Linux 2 : amazon-ecr-credential-helper, --advisory ALAS2ECS-2025-087 (ALASECS-2025-087)	Nessus	Amazon Linux Local Security Checks	high
281793	Amazon Linux 2 : amazon-ecr-credential-helper, --advisory ALAS2NITRO-ENCLAVES-2025-079 (ALASNITRO-ENCLAVES-2025-079)	Nessus	Amazon Linux Local Security Checks	high
281774	Amazon Linux 2 : ecs-init, --advisory ALAS2ECS-2025-092 (ALASECS-2025-092)	Nessus	Amazon Linux Local Security Checks	high
277513	Linux Distros Unpatched Vulnerability : CVE-2025-65637	Nessus	Misc.	high

Detections

Analytics

CVE-2025-65637

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high