CVE-2026-77620: Vector: Unauthenticated denial of service in the `logstash` source via nested compressed frames (stack exhaustion and decompression amplification).
Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source feeds each decompressed frame back into its decoder without limiting nested compression depth. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send many nested compressed frames, causing recursive decoding that exhausts the worker thread stack and aborts the process. The same nested construction amplifies decompressed input, and process termination can halt log ingestion for every tenant on a shared pipeline. This issue is fixed in version 0.57.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vectorto a version that resolves this vulnerability.Fixed in 0.57.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Vector versions from 0.15.0 up to, but not including, 0.57.0 are affected when the logstash source is reachable by a remote peer on its default 0.0.0.0:5044 listener. Shared pipelines have a broader operational impact because a process abort can halt ingestion for every tenant.
What does an attacker need to exploit the vulnerability?
An attacker does not need authentication, but must be able to reach the logstash listener. They can send nested compressed frames that trigger recursive decoding, stack exhaustion, and decompression amplification.
What should be done if an immediate upgrade is not possible?
Restrict network access to the logstash listener so untrusted remote peers cannot reach port 5044. This reduces exposure because exploitation requires network reachability to that listener.
How can I determine whether my Vector instance is affected?
Check whether the logstash source is enabled and reachable on the default 0.0.0.0:5044 listener, then verify the Vector version. Versions before 0.15.0 and version 0.57.0 are not identified as affected; versions from 0.15.0 until 0.57.0 are affected.