The vulnerability resides in Vector's logstash source component, which accepts compressed frames without limiting nested compression. An unauthenticated external host can send many nested compressed frames to the default listener binding on all interfaces. The decoder recursively processes the frames, eventually exceeding the stack allocated to the worker thread and forcing the process to abort. The recursion also applies decompression amplification; the attacker can send a small payload that expands to a large amount of data, further exhausting system resources. The resulting failure stops log ingestion for every tenant on a shared pipeline and constitutes an unavailability attack.

Vectordotdev's Vector product, versions 0.15.0 through 0.56.x, is affected. The vulnerable logstash source listens on TCP port 5044 on all network interfaces (0.0.0.0). Users running these versions on public or shared infrastructure face the risk until they upgrade to version 0.57.0, which contains the fix.

The CVSS base score of 8.7 classifies this flaw as High severity. The EPSS score is not available, so the precise exploitation probability cannot be quantified, but the lack of authentication and wide exposure of the listener make a real-world attack likely if unmitigated. The vulnerability is not currently listed in the CISA KEV catalog, yet its impact is significant for multi-tenant environments where a single abort can take the pipeline offline. An attacker must only be able to reach the host on port 5044; no privileges or credentials are required.