CVE-2026-77620: Vector Data Pipeline DOS Vulnerability

CVE-2026-77620 Overview

Vector is a high-performance observability data pipeline maintained by the vectordotdev project. CVE-2026-77620 affects the logstash source in Vector versions 0.15.0 through 0.56.x. The source feeds each decompressed frame back into its decoder without limiting nested compression depth. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send many nested compressed frames. Recursive decoding exhausts the worker thread stack and aborts the Vector process. The issue is fixed in version 0.57.0.

Critical Impact
Process termination halts log ingestion for every tenant on a shared pipeline, and the nested construction also amplifies decompressed input volume.

Affected Products

Vector 0.15.0 through 0.56.x (vectordotdev/vector)
Deployments exposing the logstash source on the default 0.0.0.0:5044 listener
Multi-tenant observability pipelines ingesting Lumberjack/Beats traffic

Discovery Timeline

2026-09-22 - CVE-2026-77620 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-77620

Vulnerability Analysis

The logstash source in Vector implements the Lumberjack/Beats protocol, which defines a compressed (C) frame type that wraps other frames such as data, JSON, and window-size frames. Before 0.57.0, the decoder reused itself to parse the decompressed payload without tracking whether it was already inside a compressed context. An attacker can nest C frames arbitrarily deep, and each layer triggers another recursive call into decode_compressed_frame. The recursion consumes the worker thread's stack until the process aborts. Because Vector often serves as a shared ingestion pipeline, a single unauthenticated peer can halt log delivery for every tenant on that instance. This behavior maps to [CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)] with a secondary recursion-depth component related to [CWE-674].

Root Cause

The LogstashDecoder struct did not carry state indicating that decoding was already occurring on a decompressed payload. When it encountered another compressed frame inside the decompressed output, it recursed rather than rejecting the input. No legitimate Lumberjack/Beats client such as Filebeat emits nested compression, so recursive handling served no protocol purpose.

Attack Vector

The vulnerability is reachable over the network without authentication or user interaction. Any host able to send TCP traffic to the Vector logstash listener, typically bound to 0.0.0.0:5044, can transmit a crafted stream of nested C frames. Each additional nesting level increases stack usage during decoding, and sufficient depth aborts the Vector process and severs ingestion for all connected producers.

rust

     // preserve sender window boundaries even if ReadyFrames later batches
     // multiple decoded windows together before ACKing.
     window_events_remaining: Option<NonZeroUsize>,
+    // Set for the decoder used to parse a decompressed payload. No known
+    // Lumberjack/Beats client emits a compressed frame nested inside another,
+    // so a nested `C` frame here is rejected rather than recursed into.
+    // Without this, an attacker could nest compressed frames arbitrarily deep
+    // and drive unbounded recursion in `decode_compressed_frame`, exhausting
+    // the stack (CWE-674).
+    nested: bool,
 }
 
 impl LogstashDecoder {

Source: Vector commit 57fed99

The patch adds a nested: bool flag to LogstashDecoder. When the decoder is instantiated to parse a decompressed payload, the flag is set, and any further C frame encountered is rejected as a decode error, closing the connection before recursion can occur.

Detection Methods for CVE-2026-77620

Indicators of Compromise

Unexpected Vector process aborts or restarts with stack overflow signatures in system logs.
Sudden gaps in log ingestion across multiple tenants sharing a Vector instance.
Inbound TCP connections to port 5044 from unknown or untrusted source addresses.
Anomalously small inbound payloads on the logstash source producing disproportionately large decompressed volumes.

Detection Strategies

Monitor Vector for repeated crashes or systemd restart events correlated with active connections on the logstash source.
Inspect Lumberjack/Beats traffic for frames whose decompressed payload begins with another C frame header, which is not emitted by legitimate clients.
Alert on connections to :5044 originating from network segments that should not host Beats or Logstash producers.

Monitoring Recommendations

Track Vector's component_errors_total and process uptime metrics; sustained resets indicate abuse or misconfiguration.
Log firewall accept and deny events for port 5044 and correlate with pipeline health.
Forward Vector stderr and crash logs to a centralized store to catch stack-exhaustion abort messages quickly.

How to Mitigate CVE-2026-77620

Immediate Actions Required

Upgrade Vector to version 0.57.0 or later, which rejects nested compressed frames in the logstash source.
Restrict inbound access to the logstash listener so that only trusted Beats or Logstash forwarders can reach port 5044.
Audit deployments for exposure of 0.0.0.0:5044 to untrusted networks and rebind to an internal interface where possible.

Patch Information

The fix is delivered in Vector 0.57.0. See the GitHub Security Advisory GHSA-qp6f-fpfx-4gg6, the v0.57.0 release notes, the remediation commit 57fed99, and the pull request discussion #25825.

Workarounds

Place the logstash source behind a network access control list that permits only known Beats or Logstash producer IPs.
Disable the logstash source if it is not required by the deployment.
Isolate multi-tenant Vector pipelines so a single crash does not disrupt unrelated tenants until patching completes.

bash

# Verify the running Vector version and upgrade to the patched release
vector --version

# Example: pin the patched image tag in a container deployment
# docker pull timberio/vector:0.57.0-debian

# Restrict the logstash source listener with host-level firewalling (Linux example)
# Allow only trusted Beats forwarders on the ingestion segment
sudo iptables -A INPUT -p tcp --dport 5044 -s 10.0.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 5044 -j DROP