EUVD-2026-36763
GHSA-44gc-6mm4-5h7r
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-accessible HTTP endpoint, low-complexity crafted request, low-privilege auth required; pure availability impact with no confidentiality or integrity effect.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An issue in the /util/http/prelude.rs endpoint of Datadog, Inc Vector v0.54.0 allows attackers to cause a Denial of Service (DoS) via a crafted request or payload.
AnalysisAI
Uncontrolled resource consumption in Datadog Vector v0.54.0 allows authenticated remote attackers to crash or degrade the observability pipeline by sending crafted HTTP requests to the /util/http/prelude.rs handler. The vulnerability is classified as CWE-400 and carries a CVSS 3.1 score of 6.5 (Medium), requiring low-privilege network access with no user interaction. No public exploit identified at time of analysis beyond a GitHub gist that may contain proof-of-concept material; EPSS sits at 0.15% (4th percentile), indicating very low observed exploitation probability in the broader threat landscape.
Technical ContextAI
Datadog Vector is an open-source, high-performance observability data pipeline used to collect, transform, and route logs, metrics, and traces. The affected code path is /util/http/prelude.rs, a Rust module responsible for preprocessing inbound HTTP requests - likely parsing headers, framing, or accumulating request bodies before dispatch to pipeline components. CWE-400 (Uncontrolled Resource Consumption) indicates the prelude handler fails to enforce bounds on processing time, memory allocation, or connection state when encountering malformed or adversarially crafted payloads, enabling an attacker to exhaust CPU or memory and render the Vector process unresponsive. The CPE data provided (cpe:2.3:a:n/a:n/a) is a placeholder and does not resolve to a specific vendor/product entry in the NVD CPE dictionary, limiting automated correlation with other vulnerability databases.
RemediationAI
No vendor-released patch version has been independently confirmed from the available input data. The primary remediation action is to monitor the official Datadog Vector GitHub repository and release page for a patched version and upgrade from v0.54.0 as soon as one is available. In the interim, if the Vector HTTP source or HTTP-based sink components are not operationally required, disabling the HTTP listener entirely removes the attack surface with the trade-off of losing any HTTP-based ingestion. If HTTP ingestion must remain active, restrict access to the Vector HTTP endpoint using network-layer controls (firewall rules, security groups, or a reverse proxy with authentication enforcement) so that only known, trusted clients can reach the endpoint - this raises the effective privilege bar above the PR:L threshold. Rate-limiting inbound HTTP connections at the load balancer or proxy layer can reduce the impact of a DoS attempt. The NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-39197 and the referenced GitHub gist should be monitored for updated patch information.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today