CVE-2026-77619: CWE-130: Improper Handling of Length Parameter Inconsistency in vectordotdev vector
Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send a minimal frame declaring a multi-gigabyte payload, causing an excessive allocation that can abort Vector or invoke the host OOM killer. Because the allocation follows the declared length rather than bytes transmitted, the attacker has low resource cost, and process termination can halt log ingestion for every tenant on a shared pipeline. This issue is fixed in version 0.57.0.
AI Analysis
Technical Summary
Vector, a high-performance observability data pipeline, has an improper handling of length parameter inconsistency vulnerability (CWE-130) in its logstash source component. From versions 0.15.0 to 0.56.x, the software reads a 32-bit compressed-frame length from the network and uses this value to size an in-memory buffer without validating an upper bound. An unauthenticated remote attacker able to reach the default listener at 0.0.0.0:5044 can send a frame declaring a multi-gigabyte payload, causing Vector to allocate excessive memory. This can lead to process termination or the host OOM killer activating, resulting in denial of service by halting log ingestion for all tenants sharing the pipeline. The vulnerability is addressed in version 0.57.0.
Potential Impact
An unauthenticated remote attacker can cause a denial of service by sending a specially crafted frame that triggers excessive memory allocation, leading to process crash or host out-of-memory conditions. This disrupts log ingestion for all tenants on a shared Vector pipeline, potentially impacting observability and monitoring capabilities.
Mitigation Recommendations
Upgrade Vector to version 0.57.0 or later, where this vulnerability is fixed. No other mitigations are indicated in the vendor advisory. Patch status is confirmed fixed in 0.57.0.
CVE-2026-77619: CWE-130: Improper Handling of Length Parameter Inconsistency in vectordotdev vector
Description
Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send a minimal frame declaring a multi-gigabyte payload, causing an excessive allocation that can abort Vector or invoke the host OOM killer. Because the allocation follows the declared length rather than bytes transmitted, the attacker has low resource cost, and process termination can halt log ingestion for every tenant on a shared pipeline. This issue is fixed in version 0.57.0.
CVSS v4.0
Score 8.7high
Affected software
vectordotdev
vector
pkg:cargo/github/vectordotdev/vectorRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Vector, a high-performance observability data pipeline, has an improper handling of length parameter inconsistency vulnerability (CWE-130) in its logstash source component. From versions 0.15.0 to 0.56.x, the software reads a 32-bit compressed-frame length from the network and uses this value to size an in-memory buffer without validating an upper bound. An unauthenticated remote attacker able to reach the default listener at 0.0.0.0:5044 can send a frame declaring a multi-gigabyte payload, causing Vector to allocate excessive memory. This can lead to process termination or the host OOM killer activating, resulting in denial of service by halting log ingestion for all tenants sharing the pipeline. The vulnerability is addressed in version 0.57.0.
Potential Impact
An unauthenticated remote attacker can cause a denial of service by sending a specially crafted frame that triggers excessive memory allocation, leading to process crash or host out-of-memory conditions. This disrupts log ingestion for all tenants on a shared Vector pipeline, potentially impacting observability and monitoring capabilities.
Mitigation Recommendations
Upgrade Vector to version 0.57.0 or later, where this vulnerability is fixed. No other mitigations are indicated in the vendor advisory. Patch status is confirmed fixed in 0.57.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-20T20:52:01.926Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab29fbaf7a7c541065ca85e
Added to database: 09/22/2026, 15:33:14 UTC
Last enriched: 09/22/2026, 15:49:00 UTC
Last updated: 09/23/2026, 01:58:06 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.