A critical vulnerability in the Vector observability pipeline allows unauthenticated attackers to trigger a process crash and service outage through recursive decompression attacks.

The Logstash source component fails to limit the depth of nested compressed data, leading to a stack exhaustion vulnerability (CWE-409). Unauthenticated remote peers can trigger this behavior, causing the application to abort and halting log ingestion for all tenants.

The exploitation of this flaw leads to a complete denial of service for the Vector observability pipeline, which is a critical piece of infrastructure for log monitoring and security telemetry. Given the CVSS score of 8.7, this represents a high-severity risk that could result in significant operational disruption, loss of visibility into system events, and potential blind spots during an ongoing security incident.

Immediate Action: Update the Vector deployment to version 0.57.0 or later to implement the required compression depth limits.

Proactive Monitoring: Monitor system logs for repeated process crashes or unusual spikes in resource consumption on the port 5044 listener.

Compensating Controls: If immediate patching is not feasible, restrict network access to the Vector Logstash source (port 5044) to trusted IP ranges only via network firewalls or access control lists.

Public Exploit Available: No

The vulnerability presents a significant risk to the availability of observability infrastructure. Security teams should prioritize the update to version 0.57.0 across all environments to ensure that the recursive decoding flaw is neutralized. Given the ease of exploitation, applying the patch is the only reliable method to prevent potential service disruption by external actors.