Buffer Overflow Vulnerability in Vector by Vector Dev

CVE-2026-77619

What is CVE-2026-77619?

A buffer overflow vulnerability exists in Vector, a high-performance observability data pipeline, affecting versions 0.15.0 to 0.57.0. The issue arises when the logstash source reads a compressed-frame length from the network and allocates memory without proper bounds. This flaw allows an unauthenticated remote peer, capable of connecting to the default listener, to send a deceptively small frame claiming a multi-gigabyte payload. Such an attack can lead to excessive memory allocation, potentially crashing the Vector service or invoking the host's OOM killer, thereby disrupting log ingestion across all tenants utilizing a shared pipeline. The vulnerability has been addressed in version 0.57.0, securing the memory allocation process.

References