Skip to content
Fencer Vulns
high 8.7

CVE-2026-77619 json

Vector: Unauthenticated denial of service in the `logstash` source via unbounded memory allocation.

published 2026-09-22 47 d ago modified 2026-09-24 45 d ago also EUVD-2026-84505

cvss
8.7
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits
0
none known

Summary

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send a minimal frame declaring a multi-gigabyte payload, causing an excessive allocation that can abort Vector or invoke the host OOM killer. Because the allocation follows the declared length rather than bytes transmitted, the attacker has low resource cost, and process termination can halt log ingestion for every tenant on a shared pipeline. This issue is fixed in version 0.57.0.

Patch / fix

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-77619 updated cvss 7.5

vector: Vector: Denial of Service via unbounded memory allocation in Logstash source

  • Red Hat Logging Subsystem for Red Hat OpenShift 6.6 openshift-logging/vector-rhel9 1793051738
    fixed: vendor fix RHSA-2026:92515
  • Red Hat Logging Subsystem for Red Hat OpenShift 6.6 openshift-logging/eventrouter-rhel9 1792998256, openshift-logging/logging-loki-rhel9 1793041359, openshift-logging/loki-rhel9-operator 1793051099, openshift-logging/opa-openshift-rhel9 1793051110, openshift-logging/loki-operator-bundle 1793055216, openshift-logging/lokistack-gateway-rhel9 1792906475, +3 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
47 d ago

Exploit prediction

0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • vectordotdev vector

Classification

Weakness
  • CWE-130 Improper Handling of Length Parameter Inconsistency
  • CWE-789 Memory Allocation with Excessive Size Value

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.