Executive brief
Datadog Vector is a high-performance tool used for collecting and routing observability data like logs and metrics. A vulnerability in how it handles incoming data allows an attacker to send specially crafted, highly compressed requests that exhaust the system's memory. This can lead to the service crashing or becoming unresponsive, disrupting the flow of critical monitoring data across the organization.
Technical details
A Denial of Service vulnerability exists in Datadog Vector v0.54.0 due to improper resource management during the decompression and buffering of incoming requests. The affected components, including HTTP and gRPC ingest paths (such as OpenTelemetry HTTP and Splunk HEC), collect and decompress request bodies into memory before enforcing configured size limits. An attacker can exploit this by sending 'zip bombs' or oversized payloads that cause the process to exceed available memory, leading to an Out-of-Memory (OOM) termination or system unresponsiveness. The vulnerability is rooted in the /util/http/prelude.rs endpoint and related decompression helpers where the allocation boundary precedes the validation boundary.
Affected products
- Datadog Vector 0.54.0
Timeline
- 2026-06-13: other: Initial details shared via GitHub Gist
- 2026-06-15: disclosed: CVE published to NVD