The flaw lies in how the logstash source reads a 32‑bit compressed‑frame length from the network and allocates a buffer of that exact size without any upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send a minimal frame that declares a multi‑gigabyte payload. Because the allocation size is derived from the declared length rather than the number of bytes actually received, the attacker incurs negligible resource cost. The excessive allocation can cause the Vector process to abort or trigger the host OOM killer, resulting in an interruption of log ingestion for all tenants sharing the same pipeline.

The vulnerability affects Vector (vectordotdev:vector) versions from 0.15.0 through 0.57.0. The problem was resolved in 0.57.0, but earlier releases remain vulnerable.

The CVSS score of 8.7 indicates high severity, and the EPSS score is not available but the risk remains significant. The vulnerability is not listed in CISA's KEV catalog. The likely attack vector is a remote, unauthenticated network connection to the default 5044 listening port. Exploitation requires no special privileges; the attacker merely sends a crafted packet to trigger the memory over‑allocation.