Vectordotdev vulnerabilities
We track 3 vulnerabilities in Vectordotdev products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 22, 2026.
Latest Vectordotdev vulnerabilities
- 9.3 Critical severity
vector: Improper Limitation of a Pathname to a Restricted Directory
Vector is a high-performance observability data pipeline. From 0.10.0 until 0.57.0, the file sink renders its templated path from event fields and opens the result without confining it to an intended directory. When an untrusted source supplies an event field
- 8.7 High severity
vector: Improper Handling of Highly Compressed Data (Data Amplification)
Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source feeds each decompressed frame back into its decoder without limiting nested compression depth. An unauthenticated remote peer that can reach the default 0.0
- 8.7 High severity
vector: Improper Handling of Length Parameter Inconsistency
Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that