EUVD-2026-84508Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated remote attacker reaches the default listener with a simple nested-frame payload (AV:N/AC:L/PR:N/UI:N); impact is process crash only, so C:N/I:N/A:H, scope unchanged.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
6DescriptionCVE.org
Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source feeds each decompressed frame back into its decoder without limiting nested compression depth. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send many nested compressed frames, causing recursive decoding that exhausts the worker thread stack and aborts the process. The same nested construction amplifies decompressed input, and process termination can halt log ingestion for every tenant on a shared pipeline. This issue is fixed in version 0.57.0.
AnalysisAI
Denial of service in the Vector observability pipeline's logstash source (versions 0.15.0 through 0.56.x) allows a remote, unauthenticated attacker to abort the Vector process by sending a stream of deeply nested compressed frames over the Lumberjack/Beats protocol. Because the decoder recursively decompresses C frames without a depth limit, each nested layer drives the decoding thread toward stack exhaustion, and the same construction can amplify decompressed data; per the independent assessment the impact is availability only (process termination and lost log ingestion for all tenants sharing the pipeline), with no confidentiality or integrity effect, and it requires an operator to have explicitly enabled the logstash source on its default 0.0.0.0:5044 listener. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the Vector `logstash` source component to be configured and running (Vector has no sources by default - an operator must enable this input); once enabled it binds the default 0.0.0.0:5044 listener with no authentication, so any network peer that can reach that port can exploit it. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded availability risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Vector 0.57.0, which rejects nested compressed frames in the `logstash` source (PR #25825, commit 57fed991083c9a43d5fda2d5b3bf4718aedf6526; advisory GHSA-qp6f-fpfx-4gg6). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Vector deployments and confirm which are running versions 0.15.0 through 0.56.x with the logstash source enabled, then immediately reduce exposure by disabling that source where it is not required and restricting the default 0.0.0.0:5044 listener via firewall or security-group rules to only trusted Beats/Lumberjack senders, while adding alerting on unexpected Vector process exits. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PH
In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the ele
In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer ove
Stored cross-site scripting and open redirect in Warpgate's SSO endpoints (versions prior to 0.25.5) allow an unauthenti
library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginni
The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, c
In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once fo
In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe c
Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration
Rust is a programming language. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no auth
The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contai
Unconfined template path resolution in the Vector observability pipeline's file sink allows attacker-influenced event da
Share
External POC / Exploit Code
Leaving vuln.today