Vector
Monthly
Unconfined template path resolution in the Vector observability pipeline's file sink allows attacker-influenced event data to create or overwrite files anywhere the Vector process has write access, affecting versions 0.10.0 up to but not including 0.57.0. Because the rendered path is opened without confinement to an intended directory, a crafted event field can supply an absolute path or '../' traversal, and Vector will even create the missing parent directories before writing. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but impact is severe (CVSS 4.0 base 9.3 / assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) and escalates to code execution when the overwritten target is a scheduled task, authorization file, or subsequently executed script. Real-world risk is configuration-gated: it requires a file sink whose path template interpolates an untrusted event field, and the damage ceiling tracks the privileges Vector runs with.
Denial of service in the Vector observability pipeline's `logstash` source (versions 0.15.0 through 0.56.x) allows a remote, unauthenticated attacker to abort the Vector process by sending a stream of deeply nested compressed frames over the Lumberjack/Beats protocol. Because the decoder recursively decompresses `C` frames without a depth limit, each nested layer drives the decoding thread toward stack exhaustion, and the same construction can amplify decompressed data; per the independent assessment the impact is availability only (process termination and lost log ingestion for all tenants sharing the pipeline), with no confidentiality or integrity effect, and it requires an operator to have explicitly enabled the `logstash` source on its default 0.0.0.0:5044 listener. There is no indication of active exploitation (no CISA KEV entry) and no public exploit code identified at time of analysis; the issue is remediated in Vector 0.57.0.
Unauthenticated remote attackers who can reach the Vector `logstash` source listener (default 0.0.0.0:5044) can force a multi-gigabyte memory allocation and terminate the process by sending a single minimal Lumberjack frame that merely declares a huge compressed-frame length, without transmitting those bytes. Deployments running the logstash source in Vector 0.15.0 through 0.56.x are affected; the issue is fixed in 0.57.0 by capping declared and decompressed frame sizes. Impact is availability only (crash or host OOM kill that halts log ingestion for every tenant on a shared pipeline) with no code execution or data exposure, and no public exploit code identified at time of analysis.
Unconfined template path resolution in the Vector observability pipeline's file sink allows attacker-influenced event data to create or overwrite files anywhere the Vector process has write access, affecting versions 0.10.0 up to but not including 0.57.0. Because the rendered path is opened without confinement to an intended directory, a crafted event field can supply an absolute path or '../' traversal, and Vector will even create the missing parent directories before writing. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but impact is severe (CVSS 4.0 base 9.3 / assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) and escalates to code execution when the overwritten target is a scheduled task, authorization file, or subsequently executed script. Real-world risk is configuration-gated: it requires a file sink whose path template interpolates an untrusted event field, and the damage ceiling tracks the privileges Vector runs with.
Denial of service in the Vector observability pipeline's `logstash` source (versions 0.15.0 through 0.56.x) allows a remote, unauthenticated attacker to abort the Vector process by sending a stream of deeply nested compressed frames over the Lumberjack/Beats protocol. Because the decoder recursively decompresses `C` frames without a depth limit, each nested layer drives the decoding thread toward stack exhaustion, and the same construction can amplify decompressed data; per the independent assessment the impact is availability only (process termination and lost log ingestion for all tenants sharing the pipeline), with no confidentiality or integrity effect, and it requires an operator to have explicitly enabled the `logstash` source on its default 0.0.0.0:5044 listener. There is no indication of active exploitation (no CISA KEV entry) and no public exploit code identified at time of analysis; the issue is remediated in Vector 0.57.0.
Unauthenticated remote attackers who can reach the Vector `logstash` source listener (default 0.0.0.0:5044) can force a multi-gigabyte memory allocation and terminate the process by sending a single minimal Lumberjack frame that merely declares a huge compressed-frame length, without transmitting those bytes. Deployments running the logstash source in Vector 0.15.0 through 0.56.x are affected; the issue is fixed in 0.57.0 by capping declared and decompressed frame sizes. Impact is availability only (crash or host OOM kill that halts log ingestion for every tenant on a shared pipeline) with no code execution or data exposure, and no public exploit code identified at time of analysis.