Executive brief
Vector is a data pipeline tool used to collect and process logs across infrastructure. An attacker without authentication can send specially crafted compressed log frames to the default listener, causing the application to recursively decompress them and exhaust the worker process. This crashes Vector and halts log collection for all tenants sharing the same pipeline.
Technical details
The logstash source in Vector versions 0.15.0–0.57.0 does not validate nesting depth of compressed frames, allowing recursive decompression attacks. An unauthenticated remote attacker reaching the default 0.0.0.0:5044 listener can send nested compressed payloads that amplify decompressed size, causing stack exhaustion and worker thread abort. The fix (v0.57.0) rejects compressed frames nested inside compressed frames.
Affected products
- Datadog Vector 0.15.0 to 0.57.0
Timeline
- 2026-09-22: disclosed
- 2026-07-13: patched: Fixed in v0.57.0