The flaw lies in how the logstash source reads a 32‑bit compressed‑frame length from the network and allocates a buffer of that exact size without any upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send a minimal frame that declares a multi‑gigabyte payload. Because the allocation size is derived from the declared length rather than the number of bytes actually received, the attacker incurs negligible resource cost. The excessive allocation can cause the Vector process to abort or trigger the host OOM killer, resulting in an interruption of log ingestion for all tenants sharing the same pipeline.

The vulnerability affects Vector (vectordotdev:vector) versions from 0.15.0 through 0.57.0. The problem was resolved in 0.57.0, but earlier releases remain vulnerable.

The CVSS score of 8.7 indicates high severity, and the EPSS score of less than 1% signals a low but nonzero likelihood of exploitation. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. The likely attack vector is a remote, unauthenticated network connection to the default 5044 listening port. Exploitation requires no special privileges; the attacker merely sends a crafted packet to trigger the memory over‑allocation.