Unauthenticated remote denial of service in the vectordotdev Vector logstash source

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send a minimal frame declaring a multi-gigabyte payload, causing an excessive allocation that can abort Vector or invoke the host OOM killer. Because the allocation follows the declared length rather than bytes transmitted, the attacker has low resource cost, and process termination can halt log ingestion for every tenant on a shared pipeline. This issue is fixed in version 0.57.0.

• vectordotdev Vector is affected in >= 0.15.0, < 0.57.0. Exposure requires the logstash source to be enabled and reachable by the attacker.
• The advisory identifies 0.0.0.0:5044 as the default listener and states that it has no authentication by default.
• The patched release is 0.57.0; the vendor advisory states that the issue is resolved in 0.57.0 and later releases.
• No separate parallel branch or backport is identified in the supplied facts or the reviewed advisory.

The logstash source reads a 32-bit compressed-frame length controlled by the network peer and uses that value to size an in-memory buffer without an upper bound. This creates an inconsistency between the declared length and the bytes actually transmitted, matching CWE-130, and permits excessive allocation, matching CWE-789. An unauthenticated remote peer only needs network reachability to the source listener; the advisory identifies 0.0.0.0:5044 as the default bind and states that the source has no authentication by default. A minimal frame declaring a multi-gigabyte payload can therefore make Vector attempt a large allocation even when little data was sent. The confirmed outcomes are process abort or host OOM-killer activation, with a possible service-wide ingestion outage on a shared pipeline. The reviewed material does not establish the exact memory limit or whether Vector or the host is terminated first in every deployment.

• Reachability: Network access to an enabled source listener is required; no local access is stated.
• Authentication and interaction: No authentication or user interaction is required according to the record and advisory.
• Complexity and cost: Attack complexity is low. A minimal frame can make the system allocate memory based on the declared length, so the attacker's resource cost is low.
• Status: The record marks public exploit as false and provides no known-exploited status. The reviewed advisory provides no public exploit, campaign, or specific IOC details; this does not prove that exploitation is absent.

The primary technical outcome is loss of availability because the attacker causes Vector to allocate memory according to an attacker-declared length, after which the process may abort or the host may invoke the OOM killer. The attacker needs no credentials or user interaction, but must be able to reach the listener and the source must be enabled. On a shared pipeline, the impact can extend to every tenant because the same process handles their ingestion. The record does not establish confidentiality or integrity impact, persistence, or host compromise. Firewall controls, network policy, or TLS client-certificate authentication can reduce reachability but do not replace the upgrade.

• Availability: Successful exploitation can terminate the Vector process or trigger the host OOM killer, stopping log ingestion for the affected process.
• Service scope: On a shared pipeline, termination of one process can interrupt ingestion for every tenant served by that pipeline.
• Operations and observability: Loss of ingestion can create observability gaps and delay subsequent detection or incident response.
• The record and advisory do not establish data disclosure, data modification, persistence, or host compromise.

1. Upgrade Vector to 0.57.0. The vendor advisory states that the issue is resolved in 0.57.0 and later releases; the associated change adds caps for compressed and decompressed payload sizes across network sources.
2. If an immediate upgrade is not possible, do not expose the logstash source to untrusted networks. Restrict the listener to trusted peers with a firewall or network policy.
3. Require TLS client-certificate authentication on the logstash source as a vendor-documented workaround.
4. Apply the change to every Vector instance and shared pipeline, because one remaining vulnerable process can interrupt ingestion for multiple tenants.

1. Inventory Vector instances, running versions, and deployments with the logstash source enabled; compare them with the affected release boundary.
2. Check the listener bind configuration and network reachability, especially 0.0.0.0:5044, together with the firewall or network policy applied to it.
3. Confirm that the listener is not exposed to untrusted networks. If an upgrade is not yet possible, verify whether TLS client-certificate authentication is required.
4. Review process and host telemetry for Vector aborts, OOM-killer events, or interruptions in log ingestion. These are operational symptoms to review, not confirmed indicators of compromise.
5. The advisory does not provide a distinctive log signature or network IOC, so the absence of those signs does not prove that the system is safe.