CVE-2026-39197: Datadog Vector DoS Vulnerability

CVE-2026-39197 Overview

CVE-2026-39197 is a denial of service vulnerability in Datadog Vector v0.54.0. The flaw resides in the /util/http/prelude.rs endpoint and allows authenticated attackers to crash or exhaust the service through a crafted request or payload. The issue is classified under [CWE-400] for uncontrolled resource consumption.

Vector is an open-source observability data pipeline used to collect, transform, and route logs, metrics, and traces. A successful attack disrupts telemetry collection across dependent monitoring infrastructure.

Critical Impact
A network-reachable attacker with low privileges can trigger high-availability impact on Vector instances, disrupting log and metric ingestion pipelines.

Affected Products

Datadog Vector v0.54.0
Deployments using the /util/http/prelude.rs HTTP handler
Observability pipelines built on the affected Vector release

Discovery Timeline

2026-06-15 - CVE-2026-39197 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-39197

Vulnerability Analysis

The vulnerability resides in the HTTP prelude handler implemented in prelude.rs within Vector's utility HTTP module. The endpoint processes incoming requests without adequate safeguards against malformed or oversized payloads. An attacker submits a crafted request that drives the service into resource exhaustion, causing availability loss.

Vector is written in Rust and serves as a high-throughput observability pipeline. Disruption of this component halts log shipping, metric collection, and trace forwarding for downstream consumers. Operators relying on Vector for security telemetry lose visibility during the outage window.

The weakness maps to [CWE-400] Uncontrolled Resource Consumption. Exploitation requires network access and at least low-level authentication to the HTTP interface. No confidentiality or integrity impact is associated with this issue.

Root Cause

The /util/http/prelude.rs code path lacks adequate input validation or resource bounds when parsing inbound HTTP requests. Crafted inputs consume disproportionate memory or CPU resources, exhausting the host and terminating the Vector process.

Attack Vector

An authenticated attacker with network reachability to the Vector HTTP listener sends a specially crafted request. The malformed payload triggers excessive resource consumption inside the HTTP prelude handler. The attack requires low complexity and no user interaction. Public exploit details are referenced in the GitHub Gist Exploit Code.

No synthetic exploit code is reproduced here. Refer to the linked gist for technical details on payload construction.

Detection Methods for CVE-2026-39197

Indicators of Compromise

Unexpected restarts or crashes of the Vector process coinciding with inbound HTTP traffic
Spikes in memory or CPU utilization on hosts running Vector v0.54.0
Gaps in log, metric, or trace ingestion that align with anomalous HTTP requests
Connections to Vector HTTP endpoints from unexpected source addresses

Detection Strategies

Monitor process telemetry for Vector exits, panics, or out-of-memory events on the host
Inspect HTTP access logs for malformed requests targeting the /util/http/prelude code path
Correlate observability pipeline outages with concurrent network activity against Vector listeners

Monitoring Recommendations

Track Vector process uptime, restart counts, and resource utilization through host metrics
Alert on sustained CPU or memory pressure exceeding baseline on Vector nodes
Restrict and log access to Vector HTTP API endpoints to detect unauthorized callers

How to Mitigate CVE-2026-39197

Immediate Actions Required

Inventory all Vector deployments and identify hosts running v0.54.0
Restrict network access to Vector HTTP endpoints using firewall rules or service mesh policies
Enforce strong authentication and rotate credentials used to access Vector management APIs
Monitor the Datadog Vector release page for a fixed version

Patch Information

No vendor patch reference is included in the NVD record at the time of publication. Operators should monitor official Datadog Vector release channels for an updated build addressing the /util/http/prelude.rs handler. Apply the fixed release as soon as it becomes available.

Workarounds

Place Vector behind a reverse proxy that enforces request size, rate, and schema validation
Apply per-source rate limiting to the Vector HTTP listener to blunt resource exhaustion attempts
Limit exposure of the HTTP interface to trusted management networks only
Run Vector under a process supervisor with resource cgroups to contain memory or CPU spikes

bash

# Configuration example: restrict Vector HTTP exposure via host firewall
sudo iptables -A INPUT -p tcp --dport 8686 -s 10.0.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 8686 -j DROP