CVE-2026-77620

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-77620

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77620.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-77620

Aliases

GHSA-qp6f-fpfx-4gg6

Published

2026-09-22T15:18:21Z

Modified

2026-09-26T03:30:54Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Vector: Unauthenticated denial of service in the `logstash` source via nested compressed frames (stack exhaustion and decompression amplification).

Details

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source feeds each decompressed frame back into its decoder without limiting nested compression depth. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send many nested compressed frames, causing recursive decoding that exhausts the worker thread stack and aborts the process. The same nested construction amplifies decompressed input, and process termination can halt log ingestion for every tenant on a shared pipeline. This issue is fixed in version 0.57.0.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-409"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77620.json"
}

References

Affected packages

Git / github.com/vectordotdev/vector

Affected ranges

Type

GIT

Repo

https://github.com/vectordotdev/vector

Events

Introduced

994d81239a9b5ea4eae3e92530e601629b593cc6

Fixed

57fed991083c9a43d5fda2d5b3bf4718aedf6526

Fixed

8832452f57afb536ea0de53a093f9fd1b669ccec

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0.15.0"
        },
        {
            "fixed":  "0.57.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77620.json"