CVE-2026-77619

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-77619

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77619.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-77619

Aliases

GHSA-rrfg-9487-mhp6

Published

2026-09-22T15:15:45Z

Modified

2026-09-24T03:46:16Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Vector: Unauthenticated denial of service in the `logstash` source via unbounded memory allocation.

Details

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send a minimal frame declaring a multi-gigabyte payload, causing an excessive allocation that can abort Vector or invoke the host OOM killer. Because the allocation follows the declared length rather than bytes transmitted, the attacker has low resource cost, and process termination can halt log ingestion for every tenant on a shared pipeline. This issue is fixed in version 0.57.0.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-130",
        "CWE-789"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77619.json"
}

References

Affected packages

Git / github.com/vectordotdev/vector

Affected ranges

Type

GIT

Repo

https://github.com/vectordotdev/vector

Events

Introduced

994d81239a9b5ea4eae3e92530e601629b593cc6

Fixed

3162ed1a2e5e8d3f210134607518a26aa01e1a37

Fixed

8832452f57afb536ea0de53a093f9fd1b669ccec

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0.15.0"
        },
        {
            "fixed":  "0.57.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77619.json"