EUVD-2026-36763
GHSA-44gc-6mm4-5h7r
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-accessible HTTP endpoint, low-complexity crafted request, low-privilege auth required; pure availability impact with no confidentiality or integrity effect.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionCVE.org
An issue in the /util/http/prelude.rs endpoint of Datadog, Inc Vector v0.54.0 allows attackers to cause a Denial of Service (DoS) via a crafted request or payload.
AnalysisAI
Uncontrolled resource consumption in Datadog Vector v0.54.0 allows authenticated remote attackers to crash or degrade the observability pipeline by sending crafted HTTP requests to the /util/http/prelude.rs handler. The vulnerability is classified as CWE-400 and carries a CVSS 3.1 score of 6.5 (Medium), requiring low-privilege network access with no user interaction. No public exploit identified at time of analysis beyond a GitHub gist that may contain proof-of-concept material; EPSS sits at 0.15% (4th percentile), indicating very low observed exploitation probability in the broader threat landscape.
Technical ContextAI
Datadog Vector is an open-source, high-performance observability data pipeline used to collect, transform, and route logs, metrics, and traces. The affected code path is /util/http/prelude.rs, a Rust module responsible for preprocessing inbound HTTP requests - likely parsing headers, framing, or accumulating request bodies before dispatch to pipeline components. CWE-400 (Uncontrolled Resource Consumption) indicates the prelude handler fails to enforce bounds on processing time, memory allocation, or connection state when encountering malformed or adversarially crafted payloads, enabling an attacker to exhaust CPU or memory and render the Vector process unresponsive. The CPE data provided (cpe:2.3:a:n/a:n/a) is a placeholder and does not resolve to a specific vendor/product entry in the NVD CPE dictionary, limiting automated correlation with other vulnerability databases.
RemediationAI
No vendor-released patch version has been independently confirmed from the available input data. The primary remediation action is to monitor the official Datadog Vector GitHub repository and release page for a patched version and upgrade from v0.54.0 as soon as one is available. In the interim, if the Vector HTTP source or HTTP-based sink components are not operationally required, disabling the HTTP listener entirely removes the attack surface with the trade-off of losing any HTTP-based ingestion. If HTTP ingestion must remain active, restrict access to the Vector HTTP endpoint using network-layer controls (firewall rules, security groups, or a reverse proxy with authentication enforcement) so that only known, trusted clients can reach the endpoint - this raises the effective privilege bar above the PR:L threshold. Rate-limiting inbound HTTP connections at the load balancer or proxy layer can reduce the impact of a DoS attempt. The NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-39197 and the referenced GitHub gist should be monitored for updated patch information.
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today