An unauthenticated remote denial of service vulnerability in Vector, caused by improper handling of length parameters, poses a high risk to observability pipeline stability.

The vulnerability is an improper handling of a length parameter (CWE-130) and memory allocation with an excessive size value (CWE-789) in the logstash source. An unauthenticated attacker can send a specially crafted frame to the network listener, forcing the application to allocate excessive memory and triggering a crash or an OOM kill.

The exploitation of this flaw leads to the immediate termination of the Vector process, resulting in a total loss of observability data ingestion. Given the CVSS score of 8.7, this is a high-severity issue that could disrupt monitoring for all tenants on a shared pipeline, significantly impacting operational visibility and incident response capabilities.

Immediate Action: Update the Vector software to version 0.57.0 or later to include the necessary bounds checking on incoming frame payloads.

Proactive Monitoring: Monitor system logs and resource utilization metrics for sudden spikes in memory usage or unexpected process crashes associated with the logstash listener port 5044.

Compensating Controls: Restrict network access to the 0.0.0.0:5044 listener using host-based firewalls or network access control lists to ensure only trusted sources can communicate with the service.

Public Exploit Available: No

This vulnerability represents a significant threat to infrastructure reliability due to its potential for remote, unauthenticated service disruption. Organizations currently running affected versions of Vector should prioritize the transition to version 0.57.0 as part of their next maintenance cycle. Until patching is completed, ensure that network exposure of the affected listener is strictly limited to authorized traffic sources.