CVE-2026-77619: Vector Observability Pipeline DOS Vulnerability

CVE-2026-77619 Overview

CVE-2026-77619 is an unbounded memory allocation vulnerability in Vector, a high-performance observability data pipeline maintained by Datadog. The flaw affects the logstash source in versions from 0.15.0 up to (but not including) 0.57.0. An unauthenticated remote attacker who can reach the default 0.0.0.0:5044 listener can send a minimal frame declaring a multi-gigabyte payload. Vector trusts the declared 32-bit compressed-frame length and allocates a buffer of that size without validation, terminating the process or triggering the host OOM killer. The weakness is classified as [CWE-130] Improper Handling of Length Parameter Inconsistency.

Critical Impact

A single unauthenticated network packet can crash Vector and halt log ingestion for every tenant on a shared pipeline.

Affected Products

• Vector (vectordotdev/vector) versions 0.15.0 through 0.56.x
• Deployments exposing the logstash source on the default 0.0.0.0:5044 listener
• Multi-tenant observability pipelines relying on Vector for log ingestion

Discovery Timeline

• 2026-09-22 - CVE-2026-77619 published to NVD
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-77619

Vulnerability Analysis

The logstash source in Vector implements the Lumberjack protocol used by Elastic Beats agents. Each frame begins with a 32-bit length prefix describing the compressed payload size. The source reads this length directly from the network and uses it to size an in-memory buffer. No upper bound is enforced before allocation occurs.

An attacker can send a well-formed frame header advertising a payload of several gigabytes while transmitting only a handful of bytes. Vector proceeds to request the declared amount of memory, triggering process abort or invocation of the Linux OOM killer. Because Vector often serves as a shared ingestion tier, one crash halts telemetry for every downstream tenant.

Root Cause

The root cause is trust in an attacker-controlled length field. The source parses the compressed-frame length prefix and passes it to buffer allocation logic without cross-checking against bytes actually available on the socket or against a configured maximum. This is a textbook [CWE-130] length-parameter inconsistency where declared size and transmitted size diverge.

Attack Vector

Exploitation requires network reachability to the logstash source port (default 5044) and no authentication. The attacker crafts a Lumberjack frame with a maximal 32-bit length value, sends the header plus a minimal body, and disconnects. The victim allocates memory sized by the declared field and terminates. Resource cost to the attacker is negligible, enabling repeated denial of service against restart cycles.

// Patch context - Cargo.lock: flate2 added as tracked dependency
  "chrono",
  "crossbeam-utils",
  "derivative",
+ "flate2",
  "futures",
  "indexmap 2.12.0",
  "itertools 0.14.0",
// Source: https://github.com/vectordotdev/vector/commit/3162ed1a2e5e8d3f210134607518a26aa01e1a37

// Patch context - Cargo.toml: zstd dependency added for bounded decompression
+zstd = { version = "0.13.0", default-features = false }
 mock_instant = { version = "0.6" }
 serial_test = { version = "3.4" }
// Source: https://github.com/vectordotdev/vector/commit/3162ed1a2e5e8d3f210134607518a26aa01e1a37

The fix caps both compressed and decompressed payload sizes across the network source. See the GitHub Security Advisory GHSA-rrfg-9487-mhp6 and Pull Request 25819 for full patch details.

Detection Methods for CVE-2026-77619

Indicators of Compromise

• Unexpected Vector process termination or restart events accompanied by SIGKILL from the kernel OOM killer
• Kernel log entries referencing Out of memory: Killed process naming the vector binary
• Sudden spikes in resident set size (RSS) for the Vector process immediately following inbound traffic to TCP 5044
• Loss of log ingestion for downstream sinks without corresponding upstream agent errors

Detection Strategies

• Monitor Vector's Prometheus internal metrics for abnormal component_received_bytes_total versus component_errors_total ratios on the logstash source
• Alert on TCP connections to port 5044 that transmit fewer than 64 bytes before disconnecting
• Correlate Vector process restarts with inbound netflow to the logstash listener
• Track host memory pressure events on nodes running Vector as a service

Monitoring Recommendations

• Ingest Linux dmesg and /var/log/messages into a central logging tier and alert on OOM killer invocations naming vector
• Instrument systemd Restart= counters and page on repeated crashes within short windows
• Baseline expected connection sizes for legitimate Beats agents to spot anomalously small frames declaring large payloads

How to Mitigate CVE-2026-77619

Immediate Actions Required

• Upgrade Vector to version 0.57.0 or later, which caps both compressed and decompressed payload sizes on network sources
• Restrict network exposure of the logstash source to trusted Beats agents using firewall rules or a private network segment
• Enable TLS client authentication on the logstash source to prevent unauthenticated peers from reaching the parser
• Audit all Vector deployments for exposed 0.0.0.0:5044 listeners

Patch Information

The fix ships in Vector v0.57.0 via commit 3162ed1. The patch introduces bounded buffer allocation for both compressed and decompressed payloads across network sources and adds flate2 and zstd as tracked dependencies for controlled decompression. Full details are published in GHSA-rrfg-9487-mhp6.

Workarounds

• Bind the logstash source to a loopback or management interface instead of 0.0.0.0 until the upgrade is applied
• Place Vector behind a reverse proxy or load balancer that enforces a maximum request body size below the process memory budget
• Apply host-level cgroup memory limits so an OOM event terminates only Vector rather than co-located services

# Configuration example - restrict logstash source binding and require TLS
[sources.beats_in]
type = "logstash"
address = "127.0.0.1:5044"

[sources.beats_in.tls]
enabled = true
verify_certificate = true
crt_file = "/etc/vector/tls/server.crt"
key_file = "/etc/vector/tls/server.key"
ca_file = "/etc/vector/tls/ca.crt"