Nixpkgs security tracker

Try the new UI
Login with GitHub

Details of issue NIXPKGS-2026-2718

NIXPKGS-2026-2718
published 9 hours ago
vector: security issues < 0.57.0 (backport needed)
Permalink CVE-2026-77621
9.3 CRITICAL
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): None (N)
  • Subsequent System Impact Confidentiality (SC): High (H)
  • Subsequent System Impact Integrity (SI): High (H)
  • Subsequent System Impact Availability (SA): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): None (N)
  • Modified Subsequent System Impact Confidentiality (MSC): High (H)
  • Modified Subsequent System Impact Integrity (MSI): High (H)
  • Modified Subsequent System Impact Availability (MSA): High (H)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 9 hours ago by @LeSuisse Activity log
  • Created suggestion
  • @LeSuisse ignored
    119 packages
    • pathvector
    • vector-blf
    • vectorcode
    • vectoroids
    • vectorscan
    • pkgsRocm.vectorcode
    • ocamlPackages.vector
    • haskellPackages.vector
    • perlPackages.BitVector
    • perl5Packages.BitVector
    • sbclPackages.cl-vectors
    • akkuPackages.pfds-vector
    • python313Packages.vector
    • python314Packages.vector
    • akkuPackages.rapid-vector
    • haskellPackages.AC-Vector
    • haskellPackages.gb-vector
    • haskellPackages.hw-vector
    • haskellPackages.bit-vector
    • haskellPackages.rrb-vector
    • haskellPackages.vector-fft
    • python313Packages.pgvector
    • python314Packages.pgvector
    • vimPlugins.vectorcode-nvim
    • haskellPackages.vector-fftw
    • haskellPackages.vector-mmap
    • haskellPackages.word-vector
    • ocamlPackages_latest.vector
    • postgresqlPackages.pgvector
    • sbclPackages.static-vectors
    • haskellPackages.fixed-vector
    • haskellPackages.vector-sized
    • haskellPackages.vector-space
    • haskellPackages.vector-split
    • akkuPackages.chibi-bytevector
    • akkuPackages.r6rs-bytevectors
    • haskellPackages.cereal-vector
    • haskellPackages.sparse-vector
    • haskellPackages.vector-binary
    • haskellPackages.vector-buffer
    • haskellPackages.vector-extras
    • haskellPackages.vector-rotcev
    • haskellPackages.vector-stream
    • postgresql14Packages.pgvector
    • postgresql15Packages.pgvector
    • postgresql16Packages.pgvector
    • postgresql17Packages.pgvector
    • postgresql18Packages.pgvector
    • postgresql19Packages.pgvector
    • haskellPackages.hybrid-vectors
    • haskellPackages.storablevector
    • haskellPackages.vector-builder
    • postgresqlPackages.vectorchord
    • haskellPackages.AC-Vector-Fancy
    • haskellPackages.hsndfile-vector
    • haskellPackages.nonempty-vector
    • haskellPackages.unboxing-vector
    • haskellPackages.validity-vector
    • haskellPackages.vector-th-unbox
    • python313Packages.staticvectors
    • python314Packages.staticvectors
    • haskellPackages.vector-instances
    • haskellPackages.vector-quicksort
    • postgresql14Packages.vectorchord
    • postgresql15Packages.vectorchord
    • postgresql16Packages.vectorchord
    • postgresql17Packages.vectorchord
    • postgresql18Packages.vectorchord
    • postgresqlPackages.pgvectorscale
    • haskellPackages.vector-algorithms
    • haskellPackages.vector-hashtables
    • haskellPackages.vector-strategies
    • haskellPackages.alternative-vector
    • haskellPackages.genvalidity-vector
    • postgresql14Packages.pgvectorscale
    • postgresql15Packages.pgvectorscale
    • postgresql16Packages.pgvectorscale
    • postgresql17Packages.pgvectorscale
    • postgresql18Packages.pgvectorscale
    • pkgsRocm.vimPlugins.vectorcode-nvim
    • haskellPackages.bytestring-to-vector
    • haskellPackages.edit-distance-vector
    • haskellPackages.hmatrix-vector-sized
    • haskellPackages.storablevector-carray
    • haskellPackages.vector-bytes-instances
    • pkgsRocm.python3Packages.staticvectors
    • python313Packages.bitvector-for-humans
    • python314Packages.bitvector-for-humans
    • haskellPackages.hsndfile-storablevector
    • haskellPackages.vector-binary-instances
    • chickenPackages_5.chickenEggs.dyn-vector
    • chickenPackages_5.chickenEggs.vector-lib
    • chickenPackages_6.chickenEggs.vector-lib
    • chickenPackages_5.chickenEggs.record-vector
    • chickenPackages_6.chickenEggs.record-vector
    • chickenPackages_5.chickenEggs.sparse-vectors
    • chickenPackages_6.chickenEggs.sparse-vectors
    • chickenPackages_5.chickenEggs.r6rs-bytevectors
    • chickenPackages_6.chickenEggs.bytevector-utils
    • chickenPackages_6.chickenEggs.r6rs-bytevectors
    • haskellPackages.uniqueness-periods-vector-stats
    • python313Packages.llama-index-vector-stores-faiss
    • python314Packages.llama-index-vector-stores-faiss
    • python313Packages.llama-index-vector-stores-chroma
    • python313Packages.llama-index-vector-stores-google
    • python313Packages.llama-index-vector-stores-milvus
    • python313Packages.llama-index-vector-stores-qdrant
    • python314Packages.llama-index-vector-stores-chroma
    • python314Packages.llama-index-vector-stores-google
    • python314Packages.llama-index-vector-stores-milvus
    • python314Packages.llama-index-vector-stores-qdrant
    • python313Packages.llama-index-vector-stores-postgres
    • python314Packages.llama-index-vector-stores-postgres
    • pkgsRocm.python3Packages.llama-index-vector-stores-faiss
    • pkgsRocm.python3Packages.llama-index-vector-stores-chroma
    • pkgsRocm.python3Packages.llama-index-vector-stores-google
    • pkgsRocm.python3Packages.llama-index-vector-stores-milvus
    • pkgsRocm.python3Packages.llama-index-vector-stores-qdrant
    • pkgsRocm.python3Packages.llama-index-vector-stores-postgres
  • @LeSuisse accepted
  • @LeSuisse published on GitHub
Vector: Arbitrary file write in the file sink via templated path (path traversal).

Vector is a high-performance observability data pipeline. From 0.10.0 until 0.57.0, the file sink renders its templated path from event fields and opens the result without confining it to an intended directory. When an untrusted source supplies an event field used by the path template, the value can contain an absolute path or parent-directory traversal, causing Vector to create parent directories and create or overwrite files outside the intended location with the Vector process privileges. The resulting file write can modify sensitive files and can lead to code execution when a scheduled task, authorization file, or subsequently executed script is targeted. This issue is fixed in version 0.57.0.

Affected products

vector
  • ==>= 0.10.0, < 0.57.0

Matching in nixpkgs

pkgs.vector

High-performance observability data pipeline

  • nixos-unstable -
  • nixos-26.05 -
Ignored packages (119)

pkgs.pathvector

Declarative edge routing platform that automates route optimization and control plane configuration

  • nixos-unstable -
    • nixos-unstable-small 6.3.2
  • nixos-26.05 -
    • nixos-26.05-small 6.3.2

pkgs.vector-blf

Library to access Binary Log File (BLF) files

  • nixos-unstable -
    • nixos-unstable-small 2.4.2

pkgs.vectorcode

Code repository indexing tool to supercharge your LLM experience

  • nixos-unstable -
  • nixos-26.05 -

pkgs.vectoroids

Clone of the classic arcade game Asteroids by Atari

  • nixos-unstable -
    • nixos-unstable-small 1.1.2
  • nixos-26.05 -
    • nixos-26.05-small 1.1.2

pkgs.vectorscan

Portable fork of the high-performance regular expression matching library

  • nixos-unstable -
  • nixos-26.05 -

pkgs.pkgsRocm.vectorcode

Code repository indexing tool to supercharge your LLM experience

  • nixos-unstable -
  • nixos-26.05 -

pkgs.perlPackages.BitVector

Efficient bit vector, set of integers and 'big int' math library

  • nixos-unstable -
    • nixos-unstable-small 7.4
  • nixos-26.05 -
    • nixos-26.05-small 7.4

pkgs.perl5Packages.BitVector

Efficient bit vector, set of integers and 'big int' math library

  • nixos-unstable -
    • nixos-unstable-small 7.4
  • nixos-26.05 -
    • nixos-26.05-small 7.4

pkgs.python313Packages.vector

Library for 2D, 3D, and Lorentz vectors, especially arrays of vectors, to solve common physics problems in a NumPy-like way

  • nixos-unstable -
    • nixos-unstable-small 1.9.0

pkgs.python314Packages.vector

Library for 2D, 3D, and Lorentz vectors, especially arrays of vectors, to solve common physics problems in a NumPy-like way

  • nixos-unstable -
    • nixos-unstable-small 1.9.0

pkgs.postgresqlPackages.vectorchord

Scalable, fast, and disk-friendly vector search in Postgres, the successor of pgvecto.rs

  • nixos-unstable -
    • nixos-unstable-small 1.1.1
  • nixos-26.05 -
    • nixos-26.05-small 1.1.1

pkgs.postgresql14Packages.vectorchord

Scalable, fast, and disk-friendly vector search in Postgres, the successor of pgvecto.rs

  • nixos-unstable -
    • nixos-unstable-small 1.1.1
  • nixos-26.05 -
    • nixos-26.05-small 1.1.1

pkgs.postgresql15Packages.vectorchord

Scalable, fast, and disk-friendly vector search in Postgres, the successor of pgvecto.rs

  • nixos-unstable -
    • nixos-unstable-small 1.1.1
  • nixos-26.05 -
    • nixos-26.05-small 1.1.1

pkgs.postgresql16Packages.vectorchord

Scalable, fast, and disk-friendly vector search in Postgres, the successor of pgvecto.rs

  • nixos-unstable -
    • nixos-unstable-small 1.1.1
  • nixos-26.05 -
    • nixos-26.05-small 1.1.1

pkgs.postgresql17Packages.vectorchord

Scalable, fast, and disk-friendly vector search in Postgres, the successor of pgvecto.rs

  • nixos-unstable -
    • nixos-unstable-small 1.1.1
  • nixos-26.05 -
    • nixos-26.05-small 1.1.1

pkgs.postgresql18Packages.vectorchord

Scalable, fast, and disk-friendly vector search in Postgres, the successor of pgvecto.rs

  • nixos-unstable -
    • nixos-unstable-small 1.1.1
  • nixos-26.05 -
    • nixos-26.05-small 1.1.1

pkgs.postgresqlPackages.pgvectorscale

Complement to pgvector for high performance, cost efficient vector search on large workloads

  • nixos-unstable -
    • nixos-unstable-small 0.9.1
  • nixos-26.05 -
    • nixos-26.05-small 0.9.0

Package maintainers

Permalink CVE-2026-77620
8.7 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 9 hours ago by @LeSuisse Activity log
  • Created suggestion
  • @LeSuisse ignored
    119 packages
    • pathvector
    • vector-blf
    • vectorcode
    • vectoroids
    • vectorscan
    • pkgsRocm.vectorcode
    • ocamlPackages.vector
    • haskellPackages.vector
    • perlPackages.BitVector
    • perl5Packages.BitVector
    • sbclPackages.cl-vectors
    • akkuPackages.pfds-vector
    • python313Packages.vector
    • python314Packages.vector
    • akkuPackages.rapid-vector
    • haskellPackages.AC-Vector
    • haskellPackages.gb-vector
    • haskellPackages.hw-vector
    • haskellPackages.bit-vector
    • haskellPackages.rrb-vector
    • haskellPackages.vector-fft
    • python313Packages.pgvector
    • python314Packages.pgvector
    • vimPlugins.vectorcode-nvim
    • haskellPackages.vector-fftw
    • haskellPackages.vector-mmap
    • haskellPackages.word-vector
    • ocamlPackages_latest.vector
    • postgresqlPackages.pgvector
    • sbclPackages.static-vectors
    • haskellPackages.fixed-vector
    • haskellPackages.vector-sized
    • haskellPackages.vector-space
    • haskellPackages.vector-split
    • akkuPackages.chibi-bytevector
    • akkuPackages.r6rs-bytevectors
    • haskellPackages.cereal-vector
    • haskellPackages.sparse-vector
    • haskellPackages.vector-binary
    • haskellPackages.vector-buffer
    • haskellPackages.vector-extras
    • haskellPackages.vector-rotcev
    • haskellPackages.vector-stream
    • postgresql14Packages.pgvector
    • postgresql15Packages.pgvector
    • postgresql16Packages.pgvector
    • postgresql17Packages.pgvector
    • postgresql18Packages.pgvector
    • postgresql19Packages.pgvector
    • haskellPackages.hybrid-vectors
    • haskellPackages.storablevector
    • haskellPackages.vector-builder
    • postgresqlPackages.vectorchord
    • haskellPackages.AC-Vector-Fancy
    • haskellPackages.hsndfile-vector
    • haskellPackages.nonempty-vector
    • haskellPackages.unboxing-vector
    • haskellPackages.validity-vector
    • haskellPackages.vector-th-unbox
    • python313Packages.staticvectors
    • python314Packages.staticvectors
    • haskellPackages.vector-instances
    • haskellPackages.vector-quicksort
    • postgresql14Packages.vectorchord
    • postgresql15Packages.vectorchord
    • postgresql16Packages.vectorchord
    • postgresql17Packages.vectorchord
    • postgresql18Packages.vectorchord
    • postgresqlPackages.pgvectorscale
    • haskellPackages.vector-algorithms
    • haskellPackages.vector-hashtables
    • haskellPackages.vector-strategies
    • haskellPackages.alternative-vector
    • haskellPackages.genvalidity-vector
    • postgresql14Packages.pgvectorscale
    • postgresql15Packages.pgvectorscale
    • postgresql16Packages.pgvectorscale
    • postgresql17Packages.pgvectorscale
    • postgresql18Packages.pgvectorscale
    • pkgsRocm.vimPlugins.vectorcode-nvim
    • haskellPackages.bytestring-to-vector
    • haskellPackages.edit-distance-vector
    • haskellPackages.hmatrix-vector-sized
    • haskellPackages.storablevector-carray
    • haskellPackages.vector-bytes-instances
    • pkgsRocm.python3Packages.staticvectors
    • python313Packages.bitvector-for-humans
    • python314Packages.bitvector-for-humans
    • haskellPackages.hsndfile-storablevector
    • haskellPackages.vector-binary-instances
    • chickenPackages_5.chickenEggs.dyn-vector
    • chickenPackages_5.chickenEggs.vector-lib
    • chickenPackages_6.chickenEggs.vector-lib
    • chickenPackages_5.chickenEggs.record-vector
    • chickenPackages_6.chickenEggs.record-vector
    • chickenPackages_5.chickenEggs.sparse-vectors
    • chickenPackages_6.chickenEggs.sparse-vectors
    • chickenPackages_5.chickenEggs.r6rs-bytevectors
    • chickenPackages_6.chickenEggs.bytevector-utils
    • chickenPackages_6.chickenEggs.r6rs-bytevectors
    • haskellPackages.uniqueness-periods-vector-stats
    • python313Packages.llama-index-vector-stores-faiss
    • python314Packages.llama-index-vector-stores-faiss
    • python313Packages.llama-index-vector-stores-chroma
    • python313Packages.llama-index-vector-stores-google
    • python313Packages.llama-index-vector-stores-milvus
    • python313Packages.llama-index-vector-stores-qdrant
    • python314Packages.llama-index-vector-stores-chroma
    • python314Packages.llama-index-vector-stores-google
    • python314Packages.llama-index-vector-stores-milvus
    • python314Packages.llama-index-vector-stores-qdrant
    • python313Packages.llama-index-vector-stores-postgres
    • python314Packages.llama-index-vector-stores-postgres
    • pkgsRocm.python3Packages.llama-index-vector-stores-faiss
    • pkgsRocm.python3Packages.llama-index-vector-stores-chroma
    • pkgsRocm.python3Packages.llama-index-vector-stores-google
    • pkgsRocm.python3Packages.llama-index-vector-stores-milvus
    • pkgsRocm.python3Packages.llama-index-vector-stores-qdrant
    • pkgsRocm.python3Packages.llama-index-vector-stores-postgres
  • @LeSuisse accepted
  • @LeSuisse published on GitHub
Vector: Unauthenticated denial of service in the `logstash` source via nested compressed frames (stack exhaustion and decompression amplification).

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source feeds each decompressed frame back into its decoder without limiting nested compression depth. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send many nested compressed frames, causing recursive decoding that exhausts the worker thread stack and aborts the process. The same nested construction amplifies decompressed input, and process termination can halt log ingestion for every tenant on a shared pipeline. This issue is fixed in version 0.57.0.

Affected products

vector
  • ==>= 0.15.0, < 0.57.0

Matching in nixpkgs

pkgs.vector

High-performance observability data pipeline

  • nixos-unstable -
  • nixos-26.05 -
Ignored packages (119)

pkgs.pathvector

Declarative edge routing platform that automates route optimization and control plane configuration

  • nixos-unstable -
    • nixos-unstable-small 6.3.2
  • nixos-26.05 -
    • nixos-26.05-small 6.3.2

pkgs.vector-blf

Library to access Binary Log File (BLF) files

  • nixos-unstable -
    • nixos-unstable-small 2.4.2

pkgs.vectorcode

Code repository indexing tool to supercharge your LLM experience

  • nixos-unstable -
  • nixos-26.05 -

pkgs.vectoroids

Clone of the classic arcade game Asteroids by Atari

  • nixos-unstable -
    • nixos-unstable-small 1.1.2
  • nixos-26.05 -
    • nixos-26.05-small 1.1.2

pkgs.vectorscan

Portable fork of the high-performance regular expression matching library

  • nixos-unstable -
  • nixos-26.05 -

pkgs.pkgsRocm.vectorcode

Code repository indexing tool to supercharge your LLM experience

  • nixos-unstable -
  • nixos-26.05 -

pkgs.perlPackages.BitVector

Efficient bit vector, set of integers and 'big int' math library

  • nixos-unstable -
    • nixos-unstable-small 7.4
  • nixos-26.05 -
    • nixos-26.05-small 7.4

pkgs.perl5Packages.BitVector

Efficient bit vector, set of integers and 'big int' math library

  • nixos-unstable -
    • nixos-unstable-small 7.4
  • nixos-26.05 -
    • nixos-26.05-small 7.4

pkgs.python313Packages.vector

Library for 2D, 3D, and Lorentz vectors, especially arrays of vectors, to solve common physics problems in a NumPy-like way

  • nixos-unstable -
    • nixos-unstable-small 1.9.0

pkgs.python314Packages.vector

Library for 2D, 3D, and Lorentz vectors, especially arrays of vectors, to solve common physics problems in a NumPy-like way

  • nixos-unstable -
    • nixos-unstable-small 1.9.0

pkgs.postgresqlPackages.vectorchord

Scalable, fast, and disk-friendly vector search in Postgres, the successor of pgvecto.rs

  • nixos-unstable -
    • nixos-unstable-small 1.1.1
  • nixos-26.05 -
    • nixos-26.05-small 1.1.1

pkgs.postgresql14Packages.vectorchord

Scalable, fast, and disk-friendly vector search in Postgres, the successor of pgvecto.rs

  • nixos-unstable -
    • nixos-unstable-small 1.1.1
  • nixos-26.05 -
    • nixos-26.05-small 1.1.1

pkgs.postgresql15Packages.vectorchord

Scalable, fast, and disk-friendly vector search in Postgres, the successor of pgvecto.rs

  • nixos-unstable -
    • nixos-unstable-small 1.1.1
  • nixos-26.05 -
    • nixos-26.05-small 1.1.1

pkgs.postgresql16Packages.vectorchord

Scalable, fast, and disk-friendly vector search in Postgres, the successor of pgvecto.rs

  • nixos-unstable -
    • nixos-unstable-small 1.1.1
  • nixos-26.05 -
    • nixos-26.05-small 1.1.1

pkgs.postgresql17Packages.vectorchord

Scalable, fast, and disk-friendly vector search in Postgres, the successor of pgvecto.rs

  • nixos-unstable -
    • nixos-unstable-small 1.1.1
  • nixos-26.05 -
    • nixos-26.05-small 1.1.1

pkgs.postgresql18Packages.vectorchord

Scalable, fast, and disk-friendly vector search in Postgres, the successor of pgvecto.rs

  • nixos-unstable -
    • nixos-unstable-small 1.1.1
  • nixos-26.05 -
    • nixos-26.05-small 1.1.1

pkgs.postgresqlPackages.pgvectorscale

Complement to pgvector for high performance, cost efficient vector search on large workloads

  • nixos-unstable -
    • nixos-unstable-small 0.9.1
  • nixos-26.05 -
    • nixos-26.05-small 0.9.0

Package maintainers

Permalink CVE-2026-77619
8.7 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): None (N)
  • Vulnerable System Impact Integrity (VI): None (N)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): None (N)
  • Modified Vulnerable System Impact Integrity (MVI): None (N)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 9 hours ago by @LeSuisse Activity log
  • Created suggestion
  • @LeSuisse ignored
    119 packages
    • pathvector
    • vector-blf
    • vectorcode
    • vectoroids
    • vectorscan
    • pkgsRocm.vectorcode
    • ocamlPackages.vector
    • haskellPackages.vector
    • perlPackages.BitVector
    • perl5Packages.BitVector
    • sbclPackages.cl-vectors
    • akkuPackages.pfds-vector
    • python313Packages.vector
    • python314Packages.vector
    • akkuPackages.rapid-vector
    • haskellPackages.AC-Vector
    • haskellPackages.gb-vector
    • haskellPackages.hw-vector
    • haskellPackages.bit-vector
    • haskellPackages.rrb-vector
    • haskellPackages.vector-fft
    • python313Packages.pgvector
    • python314Packages.pgvector
    • vimPlugins.vectorcode-nvim
    • haskellPackages.vector-fftw
    • haskellPackages.vector-mmap
    • haskellPackages.word-vector
    • ocamlPackages_latest.vector
    • postgresqlPackages.pgvector
    • sbclPackages.static-vectors
    • haskellPackages.fixed-vector
    • haskellPackages.vector-sized
    • haskellPackages.vector-space
    • haskellPackages.vector-split
    • akkuPackages.chibi-bytevector
    • akkuPackages.r6rs-bytevectors
    • haskellPackages.cereal-vector
    • haskellPackages.sparse-vector
    • haskellPackages.vector-binary
    • haskellPackages.vector-buffer
    • haskellPackages.vector-extras
    • haskellPackages.vector-rotcev
    • haskellPackages.vector-stream
    • postgresql14Packages.pgvector
    • postgresql15Packages.pgvector
    • postgresql16Packages.pgvector
    • postgresql17Packages.pgvector
    • postgresql18Packages.pgvector
    • postgresql19Packages.pgvector
    • haskellPackages.hybrid-vectors
    • haskellPackages.storablevector
    • haskellPackages.vector-builder
    • postgresqlPackages.vectorchord
    • haskellPackages.AC-Vector-Fancy
    • haskellPackages.hsndfile-vector
    • haskellPackages.nonempty-vector
    • haskellPackages.unboxing-vector
    • haskellPackages.validity-vector
    • haskellPackages.vector-th-unbox
    • python313Packages.staticvectors
    • python314Packages.staticvectors
    • haskellPackages.vector-instances
    • haskellPackages.vector-quicksort
    • postgresql14Packages.vectorchord
    • postgresql15Packages.vectorchord
    • postgresql16Packages.vectorchord
    • postgresql17Packages.vectorchord
    • postgresql18Packages.vectorchord
    • postgresqlPackages.pgvectorscale
    • haskellPackages.vector-algorithms
    • haskellPackages.vector-hashtables
    • haskellPackages.vector-strategies
    • haskellPackages.alternative-vector
    • haskellPackages.genvalidity-vector
    • postgresql14Packages.pgvectorscale
    • postgresql15Packages.pgvectorscale
    • postgresql16Packages.pgvectorscale
    • postgresql17Packages.pgvectorscale
    • postgresql18Packages.pgvectorscale
    • pkgsRocm.vimPlugins.vectorcode-nvim
    • haskellPackages.bytestring-to-vector
    • haskellPackages.edit-distance-vector
    • haskellPackages.hmatrix-vector-sized
    • haskellPackages.storablevector-carray
    • haskellPackages.vector-bytes-instances
    • pkgsRocm.python3Packages.staticvectors
    • python313Packages.bitvector-for-humans
    • python314Packages.bitvector-for-humans
    • haskellPackages.hsndfile-storablevector
    • haskellPackages.vector-binary-instances
    • chickenPackages_5.chickenEggs.dyn-vector
    • chickenPackages_5.chickenEggs.vector-lib
    • chickenPackages_6.chickenEggs.vector-lib
    • chickenPackages_5.chickenEggs.record-vector
    • chickenPackages_6.chickenEggs.record-vector
    • chickenPackages_5.chickenEggs.sparse-vectors
    • chickenPackages_6.chickenEggs.sparse-vectors
    • chickenPackages_5.chickenEggs.r6rs-bytevectors
    • chickenPackages_6.chickenEggs.bytevector-utils
    • chickenPackages_6.chickenEggs.r6rs-bytevectors
    • haskellPackages.uniqueness-periods-vector-stats
    • python313Packages.llama-index-vector-stores-faiss
    • python314Packages.llama-index-vector-stores-faiss
    • python313Packages.llama-index-vector-stores-chroma
    • python313Packages.llama-index-vector-stores-google
    • python313Packages.llama-index-vector-stores-milvus
    • python313Packages.llama-index-vector-stores-qdrant
    • python314Packages.llama-index-vector-stores-chroma
    • python314Packages.llama-index-vector-stores-google
    • python314Packages.llama-index-vector-stores-milvus
    • python314Packages.llama-index-vector-stores-qdrant
    • python313Packages.llama-index-vector-stores-postgres
    • python314Packages.llama-index-vector-stores-postgres
    • pkgsRocm.python3Packages.llama-index-vector-stores-faiss
    • pkgsRocm.python3Packages.llama-index-vector-stores-chroma
    • pkgsRocm.python3Packages.llama-index-vector-stores-google
    • pkgsRocm.python3Packages.llama-index-vector-stores-milvus
    • pkgsRocm.python3Packages.llama-index-vector-stores-qdrant
    • pkgsRocm.python3Packages.llama-index-vector-stores-postgres
  • @LeSuisse accepted
  • @LeSuisse published on GitHub
Vector: Unauthenticated denial of service in the `logstash` source via unbounded memory allocation.

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send a minimal frame declaring a multi-gigabyte payload, causing an excessive allocation that can abort Vector or invoke the host OOM killer. Because the allocation follows the declared length rather than bytes transmitted, the attacker has low resource cost, and process termination can halt log ingestion for every tenant on a shared pipeline. This issue is fixed in version 0.57.0.

Affected products

vector
  • ==>= 0.15.0, < 0.57.0

Matching in nixpkgs

pkgs.vector

High-performance observability data pipeline

  • nixos-unstable -
  • nixos-26.05 -
Ignored packages (119)

pkgs.pathvector

Declarative edge routing platform that automates route optimization and control plane configuration

  • nixos-unstable -
    • nixos-unstable-small 6.3.2
  • nixos-26.05 -
    • nixos-26.05-small 6.3.2

pkgs.vector-blf

Library to access Binary Log File (BLF) files

  • nixos-unstable -
    • nixos-unstable-small 2.4.2

pkgs.vectorcode

Code repository indexing tool to supercharge your LLM experience

  • nixos-unstable -
  • nixos-26.05 -

pkgs.vectoroids

Clone of the classic arcade game Asteroids by Atari

  • nixos-unstable -
    • nixos-unstable-small 1.1.2
  • nixos-26.05 -
    • nixos-26.05-small 1.1.2

pkgs.vectorscan

Portable fork of the high-performance regular expression matching library

  • nixos-unstable -
  • nixos-26.05 -

pkgs.pkgsRocm.vectorcode

Code repository indexing tool to supercharge your LLM experience

  • nixos-unstable -
  • nixos-26.05 -

pkgs.perlPackages.BitVector

Efficient bit vector, set of integers and 'big int' math library

  • nixos-unstable -
    • nixos-unstable-small 7.4
  • nixos-26.05 -
    • nixos-26.05-small 7.4

pkgs.perl5Packages.BitVector

Efficient bit vector, set of integers and 'big int' math library

  • nixos-unstable -
    • nixos-unstable-small 7.4
  • nixos-26.05 -
    • nixos-26.05-small 7.4

pkgs.python313Packages.vector

Library for 2D, 3D, and Lorentz vectors, especially arrays of vectors, to solve common physics problems in a NumPy-like way

  • nixos-unstable -
    • nixos-unstable-small 1.9.0

pkgs.python314Packages.vector

Library for 2D, 3D, and Lorentz vectors, especially arrays of vectors, to solve common physics problems in a NumPy-like way

  • nixos-unstable -
    • nixos-unstable-small 1.9.0

pkgs.postgresqlPackages.vectorchord

Scalable, fast, and disk-friendly vector search in Postgres, the successor of pgvecto.rs

  • nixos-unstable -
    • nixos-unstable-small 1.1.1
  • nixos-26.05 -
    • nixos-26.05-small 1.1.1

pkgs.postgresql14Packages.vectorchord

Scalable, fast, and disk-friendly vector search in Postgres, the successor of pgvecto.rs

  • nixos-unstable -
    • nixos-unstable-small 1.1.1
  • nixos-26.05 -
    • nixos-26.05-small 1.1.1

pkgs.postgresql15Packages.vectorchord

Scalable, fast, and disk-friendly vector search in Postgres, the successor of pgvecto.rs

  • nixos-unstable -
    • nixos-unstable-small 1.1.1
  • nixos-26.05 -
    • nixos-26.05-small 1.1.1

pkgs.postgresql16Packages.vectorchord

Scalable, fast, and disk-friendly vector search in Postgres, the successor of pgvecto.rs

  • nixos-unstable -
    • nixos-unstable-small 1.1.1
  • nixos-26.05 -
    • nixos-26.05-small 1.1.1

pkgs.postgresql17Packages.vectorchord

Scalable, fast, and disk-friendly vector search in Postgres, the successor of pgvecto.rs

  • nixos-unstable -
    • nixos-unstable-small 1.1.1
  • nixos-26.05 -
    • nixos-26.05-small 1.1.1

pkgs.postgresql18Packages.vectorchord

Scalable, fast, and disk-friendly vector search in Postgres, the successor of pgvecto.rs

  • nixos-unstable -
    • nixos-unstable-small 1.1.1
  • nixos-26.05 -
    • nixos-26.05-small 1.1.1

pkgs.postgresqlPackages.pgvectorscale

Complement to pgvector for high performance, cost efficient vector search on large workloads

  • nixos-unstable -
    • nixos-unstable-small 0.9.1
  • nixos-26.05 -
    • nixos-26.05-small 0.9.0

Package maintainers

Needs a backport