---
id: CVE-2026-77619
title: Vector is a high-performance observability data pipeline
summary: >-
  Vector is a high-performance observability data pipeline. From 0.15.0 until
  0.57.0, the logstash source reads a 32-bit compressed-frame length from the
  network and uses it to size an in-memory buffer without an upper bound. An
  unauthenti…
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-130
  - CWE-789
vendor: vectordotdev
product: vector
affected:
  - 'vector >= 0.15.0, < 0.57.0'
published: '2026-09-22'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:23:54.397'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-77619'
references:
  - url: >-
      https://github.com/vectordotdev/vector/commit/3162ed1a2e5e8d3f210134607518a26aa01e1a37
    label: security-advisories@github.com
  - url: 'https://github.com/vectordotdev/vector/pull/25819'
    label: security-advisories@github.com
  - url: 'https://github.com/vectordotdev/vector/releases/tag/v0.57.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/vectordotdev/vector/security/advisories/GHSA-rrfg-9487-mhp6
    label: security-advisories@github.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77619.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-77619'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-77619'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00524
epssPercentile: 0.41917
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-22T16:06:34.991536Z'
cvssSource: cna
ingestedAt: '2026-09-22T16:06:00.498Z'
scores:
  cna: 8.7
  vendor: 7.5
---

## Overview

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send a minimal frame declaring a multi-gigabyte payload, causing an excessive allocation that can abort Vector or invoke the host OOM killer. Because the allocation follows the declared length rather than bytes transmitted, the attacker has low resource cost, and process termination can halt log ingestion for every tenant on a shared pipeline. This issue is fixed in version 0.57.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · updated 2026-09-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77619.json)