Denial of Service Vulnerability in Vector Data Pipeline Software
CVE-2026-77620

8.7HIGH

Key Information:

Vendor

Vectordotdev

Status
Vector
Vendor
CVE Published:
22 September 2026

What is CVE-2026-77620?

A vulnerability in Vector allows an unauthenticated remote peer to exploit the logstash source by sending numerous nested compressed frames. This can lead to recursive decoding, resulting in exhaustion of the worker thread stack and process termination. Such a denial of service condition halts log ingestion for all tenants on shared pipeline instances. The issue has been addressed in version 0.57.0, ensuring stability and security for users.

Affected Version(s)

vector >= 0.15.0, < 0.57.0

References

https://github.com/vectordotdev/vector/security/advisorie...
x_refsource_CONFIRM
https://github.com/vectordotdev/vector/pull/25825
x_refsource_MISC
https://github.com/vectordotdev/vector/commit/57fed991083...
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.