CVE-2026-77620 Vector: Unauthenticated denial of service in the `logstash` source via nested compressed frames (stack exhaustion and decompression amplification).

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source feeds each decompressed frame back into its decoder without limiting nested compression depth. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send many nest...

CVE-2026-77619 Vector: Unauthenticated denial of service in the `logstash` source via unbounded memory allocation.

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044...

EUVD-2026-84505

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044...

CVE-2026-77619

CVE-2026-77619 affects the logstash source in Vector (versions 0.15.0 through 0.57.0). The vulnerability stems from the source reading a 32-bit compressed-frame length from the network and sizing an in-memory buffer without an upper bound . An unauthenticated remote peer reaching the default 0.0....

CVE-2026-77619 Vector: Unauthenticated denial of service in the `logstash` source via unbounded memory allocation.

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044...

CVE-2026-77619 Vector: Unauthenticated denial of service in the `logstash` source via unbounded memory allocation.

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044...

CVE-2026-77620: Improper Handling of Highly Compressed Data (Data Amplification)

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source feeds each decompressed frame back into its decoder without limiting nested compression depth. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send many nest...

CVE-2026-77619: Improper Handling of Length Parameter Inconsistency

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044...

GHSA-JH4V-GFQJ-7RHX vulnerabilities

Vulnerabilities for packages: thingsboard, cassandra-reaper, druid, logstash...

CLEANSTART-2026-LB17279 Security fix for GHSA-4cx2-fc23-5wg6 applied in: keycloak 26.1.4-r1, kserve-modelmesh 0.12.0-r16, logstash-fips 9.0.8-r3, orientdb 3.2.38-r0

GHSA-4cx2-fc23-5wg6 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-VS84759 Security fix for GHSA-mr3q-g2mv-mr4q applied in: logstash-fips 9.0.8-r2

Security vulnerability affects the logstash-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-LE84583 Security fix for GHSA-c2f4-jgmc-q2r5 applied in: logstash-fips 9.0.8-r2, logstash-fips 9.2.4-r1

GHSA-c2f4-jgmc-q2r5 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-RX39488 Security fix for GHSA-22h5-pq3x-2gf2 applied in: logstash-fips 9.0.8-r2, logstash-fips 9.2.4-r1

GHSA-22h5-pq3x-2gf2 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OD65831 Security fix for GHSA-72qj-48g4-5xgx applied in: logstash-fips 9.0.8-r2, logstash-fips 9.2.4-r1

GHSA-72qj-48g4-5xgx affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UU22048 Security fix for GHSA-wpv5-97wm-hp9c applied in: logstash-fips 9.0.8-r2

Security vulnerability affects the logstash-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-VI91152 Security fix for ghsa-w9pc-fmgc-vxvw applied in: logstash-fips 9.0.8-r2

Security vulnerability affects the logstash-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-NL32966 Security fix for GHSA-p543-xpfm-54cp applied in: logstash-fips 9.0.8-r2

Security vulnerability affects the logstash-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-RO71198 Security fix for GHSA-6xw4-3v39-52mm applied in: logstash-fips 9.0.8-r2

Security vulnerability affects the logstash-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-NV99070 Security fix for GHSA-vqg5-3255-v292 applied in: logstash-fips 9.0.8-r4

Security vulnerability affects the logstash-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-QG16537 Security fix for GHSA-mhwm-jh88-3gjf applied in: logstash-fips 9.0.8-r4, logstash-fips 9.2.4-r1

GHSA-mhwm-jh88-3gjf affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...