Read the docs
TI-2026-54101 Aliases CVE-2026-77619

Vector: Unauthenticated denial of service in the `logstash` source via unbounded memory allocation.

Priority MEDIUM 44CWE-130Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-789.

Summary

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send a minimal frame declaring a multi-gigabyte payload, causing an excessive allocation that can abort Vector or invoke the host OOM killer. Because the allocation follows the declared length rather than bytes transmitted, the attacker has low resource cost, and process termination can halt log ingestion for every tenant on a shared pipeline. This issue is fixed in version 0.57.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00524 44th percentileScored 2026-11-07
Fix Fixed vector (vectordotdev): 0.57.0Red Hat: 2 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vectordotdevvector0.15.0 to before 0.57.00.57.0Patch availableCNA
  • vector Vendorvectordotdev Affected 0.15.0 to before 0.57.0 Fixed in 0.57.0 Patch available CNA

Remediation

  • Fix · CNA vector (vectordotdev) Fixed in 0.57.0

Red Hat 2 advisories

  • RHSA-2026:92593 Released 2026-10-29 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.6.2
    • Logging Subsystem for Red Hat OpenShift 6.6 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/logging-loki-rhel9, registry.redhat.io/openshift-logging/loki-rhel9-operator +2
  • RHSA-2026:92515 Released 2026-10-29 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.6.2
    • Logging Subsystem for Red Hat OpenShift 6.6 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/logging-loki-rhel9, registry.redhat.io/openshift-logging/loki-rhel9-operator +2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Logging Subsystem for Red Hat OpenShift 6.6Fixed RHSA-2026:92515
Not affected: 1 product
  • Logging Subsystem for Red Hat OpenShift 6.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-77619
  2. 2026-10-30 Fix available: Logging Subsystem for Red Hat OpenShift 6.6 · Red Hat
  3. 2026-10-31 Fix available: RHSA-2026:92593 · Red Hat
  4. 2026-10-31 Fix available: RHSA-2026:92515 · Red Hat

References

Other 4

  • TI-2026-54103 Vector: Arbitrary file write in the file sink via templated path (path traversal). CVSS 4.0CRITICAL 9.3
  • TI-2026-54102 Vector: Unauthenticated denial of service in the `logstash` source via nested compressed… CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences