CVE-2026-77619
Received Received - Intake

Vector DoS via Unbounded Memory Allocation in Logstash Source

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send a minimal frame declaring a multi-gigabyte payload, causing an excessive allocation that can abort Vector or invoke the host OOM killer. Because the allocation follows the declared length rather than bytes transmitted, the attacker has low resource cost, and process termination can halt log ingestion for every tenant on a shared pipeline. This issue is fixed in version 0.57.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-77619
EUVD
EUVD-2026-84505

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
vectordotdev vector From 0.15.0 (inc) to 0.57.0 (exc)
vectordotdev vector 0.57.0
timber vector From 0.15.0 (inc) to 0.57.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
CWE-130 The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77619 is a vulnerability in Vector, an observability data pipeline tool. It allows unauthenticated remote denial of service by exploiting unbounded memory allocation in the logstash source. The issue occurs when Vector reads a 32-bit length from the network to allocate a buffer without an upper bound. An attacker can send a small frame declaring a multi-gigabyte payload, causing Vector to crash or trigger the host's OOM killer.

Detection Guidance

Check if Vector is running a vulnerable version (0.15.0 to 0.56.0) by running: vector --version. Monitor for excessive memory usage or process crashes on systems running Vector with the logstash source enabled on port 5044.

Inspect network traffic to the Vector logstash listener (default 0.0.0.0:5044) for unusually large payload declarations. Use tools like tcpdump or Wireshark to capture and analyze traffic patterns.

Impact Analysis

This vulnerability can cause Vector to crash or be terminated by the host's OOM killer, halting log ingestion for all tenants on shared pipelines. It allows low-resource attackers to disrupt services by sending minimal malicious frames that declare large payloads.

Mitigation Strategies

Upgrade Vector to version 0.57.0 or later immediately. If upgrading is not possible, restrict network access to the logstash source (port 5044) using firewalls or network policies.

Enable TLS with client-certificate authentication for the logstash source to prevent unauthenticated access. Alternatively, disable the logstash source if not in use.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77619. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart