CVE-2026-77619 in Vector
Summary
by MITRE • 09/22/2026
Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send a minimal frame declaring a multi-gigabyte payload, causing an excessive allocation that can abort Vector or invoke the host OOM killer. Because the allocation follows the declared length rather than bytes transmitted, the attacker has low resource cost, and process termination can halt log ingestion for every tenant on a shared pipeline. This issue is fixed in version 0.57.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
Vector serves as a high-performance observability data pipeline designed to collect, transform, and route logs and metrics across distributed systems. Within the architecture of Vector versions ranging from 0.15.0 through 0.57.0, the logstash source component contains a critical implementation flaw related to how it handles incoming network frames. Specifically, when receiving data via the Logstash protocol over TCP on port 5044, the software reads a 32-bit integer from the network stream that indicates the length of the compressed frame payload. This value is then used directly as the size parameter for allocating an in-memory buffer to hold the incoming data. The fundamental technical flaw lies in the absence of any upper bound validation on this declared length before memory allocation occurs, creating a classic resource exhaustion vulnerability where the application trusts untrusted input without verifying its reasonableness against system capabilities or expected payload sizes.
The operational impact of this vulnerability is severe due to the low cost for an attacker and the high availability requirements typical of observability pipelines. An unauthenticated remote peer with network access to the default listener at 0.0.0.0:5044 can exploit this flaw by sending a minimal TCP frame that declares an extremely large payload size, such as several gigabytes, without actually transmitting that volume of data. Because Vector allocates memory based on the declared length rather than the actual bytes received in transit, the attacker triggers a massive heap allocation with negligible network bandwidth consumption or CPU overhead. This disproportionate resource usage can lead to two primary failure modes: either the process will abort due to an out-of-memory condition during allocation, or it may succeed but consume enough memory to trigger the host operating system's Out-Of-Memory (OOM) killer. In a shared pipeline environment where Vector handles logs for multiple tenants or services, this single malicious request can halt log ingestion entirely, causing significant data loss and disrupting downstream monitoring and alerting capabilities across all connected systems.
From a security classification perspective, this vulnerability aligns with CWE-400, which describes uncontrolled resource consumption, specifically manifesting as an unrestricted allocation of resources within the same process or thread. The attack vector is categorized under ATT&CK technique T1498, Network Denial of Service, where the adversary leverages network-level actions to disrupt service availability rather than compromising confidentiality or integrity directly. Furthermore, it relates closely to CWE-770, Allocation of Resources Without Limits or Throttling, as the software fails to enforce limits on memory allocation relative to input size. The vulnerability is particularly dangerous because it allows for a denial-of-service attack with minimal effort and resource expenditure from the attacker's side, making it an attractive target for automated scanning tools and opportunistic attackers seeking to disrupt infrastructure stability without needing authentication credentials or complex exploitation chains.
To mitigate this risk, organizations running Vector versions prior to 0.57.0 must upgrade immediately to version 0.57.0 or later, where the developers have implemented proper bounds checking on the frame length before memory allocation occurs. In environments where upgrading is not immediately feasible, network-level controls should be deployed to restrict access to port 5044 exclusively from trusted internal subnets using firewall rules or security groups, thereby preventing unauthenticated remote peers from reaching the vulnerable listener. Additionally, configuring host-level OOM protection mechanisms and monitoring memory usage metrics can help detect anomalous allocation patterns early, although these are compensatory controls rather than definitive fixes for the underlying code defect. Ensuring that observability pipelines are not exposed to untrusted networks is a critical best practice in securing data ingestion points against resource exhaustion attacks.