CVE-2026-77619: Vector: Unauthenticated denial of service in the `logstash` source via unbounded memory allocation.
Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send a minimal frame declaring a multi-gigabyte payload, causing an excessive allocation that can abort Vector or invoke the host OOM killer. Because the allocation follows the declared length rather than bytes transmitted, the attacker has low resource cost, and process termination can halt log ingestion for every tenant on a shared pipeline. This issue is fixed in version 0.57.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vectorto a version that resolves this vulnerability.Fixed in 0.57.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Vector versions from 0.15.0 through versions before 0.57.0 are exposed when the logstash source is reachable by an unauthenticated remote peer. The described default listener is 0.0.0.0:5044, so deployments that expose that address and port are particularly at risk.
What does an attacker need to exploit it?
An attacker only needs network access to the logstash listener; no authentication is required. They can send a minimal compressed frame that declares a multi-gigabyte payload, without transmitting payload bytes of that size.
What is the operational impact of successful exploitation?
The declared frame length can cause Vector to make an excessive memory allocation, potentially aborting the process or triggering the host OOM killer. If Vector terminates, log ingestion can stop for every tenant using the affected shared pipeline.
What should be done if an immediate upgrade is not possible?
Restrict network access to the logstash listener so unauthenticated remote peers cannot reach it, especially the default 0.0.0.0:5044 binding. Upgrade to Vector 0.57.0 when possible.