CVE-2026-77619
CVE-2026-77619 is a high-severity vulnerability with a CVSS 4.0 base score of 8.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-130.
Key facts
- Severity: High (CVSS 4.0 base score 8.7)
- EPSS exploit prediction: 1% (43rd percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-130
- Published:
- Last modified:
Description
Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send a minimal frame declaring a multi-gigabyte payload, causing an excessive allocation that can abort Vector or invoke the host OOM killer. Because the allocation follows the declared length rather than bytes transmitted, the attacker has low resource cost, and process termination can halt log ingestion for every tenant on a shared pipeline. This issue is fixed in version 0.57.0.
Frequently asked questions
- What is CVE-2026-77619?
- Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send a minimal frame declaring a multi-gigabyte payload, causing an excessive allocation that can abort Vector or invoke the host OOM killer. Because the allocation follows the declared length rather than bytes transmitted, the attacker has low resource cost, and process termination can halt log ingestion for every tenant on a shared pipeline. This issue is fixed in version 0.57.0.
- How severe is CVE-2026-77619?
- CVE-2026-77619 has a CVSS 4.0 base score of 8.7, rated high severity.
- Is CVE-2026-77619 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (43rd percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-77619?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2026-77619 published?
- CVE-2026-77619 was published on 2026-09-22 and last updated on 2026-09-24.
References
- https://github.com/vectordotdev/vector/commit/3162ed1a2e5e8d3f210134607518a26aa01e1a37
- https://github.com/vectordotdev/vector/pull/25819
- https://github.com/vectordotdev/vector/releases/tag/v0.57.0
- https://github.com/vectordotdev/vector/security/advisories/GHSA-rrfg-9487-mhp6
Other CWE-130 vulnerabilities
- CVE-2022-2714 — Critical (CVSS 9.8): Improper Handling of Length Parameter Inconsistency in GitHub repository francoisjacquet/rosariosis prior to 10.0.
- CVE-2026-18397 — Critical (CVSS 9.4): This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a…
- CVE-2026-9054 — Critical (CVSS 9.2): An attacker sending tcp, il, rudp, rudp, or gre packets with a length less than the header size would trigger a kernel…
- CVE-2026-5706 — High (CVSS 8.9): In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to…
- CVE-2026-58096 — High (CVSS 8.8): LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required…
- CVE-2022-1543 — High (CVSS 8.8): Improper handling of Length parameter in GitHub repository erudika/scoold prior to 1.49.4. When the text size is large…