CVE-2026-77620
Received Received - Intake

Stack Overflow in Vector Observability Pipeline

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source feeds each decompressed frame back into its decoder without limiting nested compression depth. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send many nested compressed frames, causing recursive decoding that exhausts the worker thread stack and aborts the process. The same nested construction amplifies decompressed input, and process termination can halt log ingestion for every tenant on a shared pipeline. This issue is fixed in version 0.57.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-77620
EUVD
EUVD-2026-84508

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
vector vector 0.57.0
vector vector From 0.15.0 (inc) to 0.57.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Vector, an observability data pipeline. Between versions 0.15.0 and 0.57.0, the logstash source allows unauthenticated remote peers to send nested compressed frames to the default listener on port 5044. The system processes these frames recursively without limiting compression depth, causing stack exhaustion and process termination.

Detection Guidance

This vulnerability can be detected by monitoring for process crashes or stack overflow errors in Vector instances running versions between 0.15.0 and 0.57.0. Check logs for errors related to recursive decoding or thread stack exhaustion. Ensure Vector is updated to version 0.57.0 or later to address the issue.

Impact Analysis

An attacker could exploit this to crash Vector, halting log ingestion for all tenants on a shared pipeline. This could disrupt monitoring, logging, and data processing operations dependent on Vector.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing system unavailability due to process termination from stack exhaustion. If log ingestion halts for all tenants on a shared pipeline, it may lead to loss of critical log data required for audit trails and compliance reporting.

Mitigation Strategies

Immediately upgrade Vector to version 0.57.0 or later to patch the nested compression vulnerability. If upgrading is not possible, restrict network access to the default 0.0.0.0:5044 listener to prevent unauthenticated remote exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77620. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart