CVE-2026-77619

Name of the Vulnerable Software and Affected Versions Vector versions 0.15.0 through 0.56.0

Description The logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer accessing the default 0.0.0.0:5044 listener can send a minimal frame declaring a multi-gigabyte payload. This causes an excessive memory allocation that can abort the process or invoke the host OOM (Out of Memory) killer, which is a kernel mechanism that terminates processes to free up memory when the system is critically low. Because the allocation is based on the declared length rather than actual bytes transmitted, an attacker can halt log ingestion for all tenants on a shared pipeline with low resource cost.

Recommendations Update to version 0.57.0.