CVE-2026-77620

Name of the Vulnerable Software and Affected Versions Vector versions 0.15.0 through 0.56.0

Description The logstash source feeds each decompressed frame back into its decoder without limiting nested compression depth. An unauthenticated remote peer reaching the default 0.0.0.0:5044 listener can send multiple nested compressed frames, triggering recursive decoding that exhausts the worker thread stack and aborts the process. This construction amplifies decompressed input, and the resulting process termination can halt log ingestion for all tenants on a shared pipeline.

Recommendations Update to version 0.57.0.