---
id: CVE-2026-77620
title: Vector is a high-performance observability data pipeline
summary: >-
  Vector is a high-performance observability data pipeline. From 0.15.0 until
  0.57.0, the logstash source feeds each decompressed frame back into its
  decoder without limiting nested compression depth. An unauthenticated remote
  peer that ca…
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-409
vendor: vectordotdev
product: vector
affected:
  - 'vector >= 0.15.0, < 0.57.0'
published: '2026-09-22'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:23:54.397'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-77620'
references:
  - url: >-
      https://github.com/vectordotdev/vector/commit/57fed991083c9a43d5fda2d5b3bf4718aedf6526
    label: security-advisories@github.com
  - url: 'https://github.com/vectordotdev/vector/pull/25825'
    label: security-advisories@github.com
  - url: 'https://github.com/vectordotdev/vector/releases/tag/v0.57.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/vectordotdev/vector/security/advisories/GHSA-qp6f-fpfx-4gg6
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
epss: 0.00524
epssPercentile: 0.41908
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-22T15:40:58.864281Z'
cvssSource: cna
ingestedAt: '2026-09-22T16:06:00.482Z'
---

## Overview

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source feeds each decompressed frame back into its decoder without limiting nested compression depth. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send many nested compressed frames, causing recursive decoding that exhausts the worker thread stack and aborts the process. The same nested construction amplifies decompressed input, and process termination can halt log ingestion for every tenant on a shared pipeline. This issue is fixed in version 0.57.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.