vectordotdev vector vulnerabilities

Latest vectordotdev vector CVEs

Newest publication first

1. CVE-2026-77621 Vector: Arbitrary file write in the file sink via templated path (path traversal).

   Published 2026-09-22

   Critical·CVSS 9.3 EPSS 1.1%

   Vector is a high-performance observability data pipeline. From 0.10.0 until 0.57.0, the file sink renders its templated path from event fields and opens the result without confining it to an intended directory. When an untrusted source supplies an event field used by the path tem...

2. CVE-2026-77620 Vector: Unauthenticated denial of service in the `logstash` source via nested compressed frames (stack exhaustion and decompression amplification).

   Published 2026-09-22

   High·CVSS 8.7 EPSS 0.52%

   Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source feeds each decompressed frame back into its decoder without limiting nested compression depth. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener c...

3. CVE-2026-77619 Vector: Unauthenticated denial of service in the `logstash` source via unbounded memory allocation.

   Published 2026-09-22

   High·CVSS 8.7 EPSS 0.52%

   Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the defaul...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.