CVE-2026-39197

Executive Summary

CVE-2026-39197 is a denial-of-service (DoS) vulnerability in the /util/http/prelude.rs endpoint of Datadog Vector v0.54.0, an open-source observability data pipeline component. An unauthenticated attacker can trigger resource exhaustion by submitting a crafted HTTP request or payload to the affected endpoint, rendering the Vector instance unresponsive and disrupting log/metric/trace collection pipelines. Given Vector's role as a critical data-forwarding infrastructure component, exploitation can cause cascading monitoring failures across an organization's entire observability stack.

Technical Analysis

The vulnerability resides in the HTTP prelude module (/util/http/prelude.rs) of Datadog Vector v0.54.0. This module is responsible for parsing and normalizing incoming HTTP requests before they are routed to downstream components within Vector's internal stream-processing engine.

The root cause is improper bounds-checking and resource-limitation in the request-handling logic inside prelude.rs. When Vector's HTTP source listener accepts a connection, it invokes the prelude module to initialize the request context, validate headers, and prepare the request body for subsequent parsing. The vulnerable code path fails to enforce a maximum header count, header size, or body-length limit prior to buffering the request data.

An attacker can craft a request containing an excessive number of HTTP headers, each with an extremely long name/value pair, or a body with a massive Content-Length declaration. Vector's prelude module will attempt to store the entire request in memory without streaming or aborting when a configurable threshold is exceeded. This causes the Vector process to consume unbounded amounts of RAM and CPU time during the parsing phase.

The attack surface is the HTTP source component, which is bound to a configurable port (commonly 8686 for the http source, or port 8080 for the vector source for internal ingestion). Any network-reachable Vector instance with the HTTP source enabled is vulnerable.

The trigger does not require authentication. The prelude module processes the request before any source-level API key or token authentication is applied. Additionally, because Vector's HTTP source is frequently deployed as a public or semi-public ingestion endpoint (e.g., for receiving logs from remote agents), the vulnerability can be exploited by any remote party that can reach the listener.

Internally, the flaw is exacerbated by Vector's single-threaded async runtime model for per-connection tasks. Although Vector uses Tokio for concurrency, the request-parsing logic in prelude.rs runs synchronously per connection. A single large request will monopolize the async executor's worker thread, blocking other tasks and effectively freezing the entire pipeline.

Exploitation Scenarios

Scenario 1: Header Flood (Remote, Unauthenticated)

1. Reconnaissance: The attacker scans the target IP range for open TCP port 8686 or 8080. Using a banner-grab (curl -I http://target:8686) or by sending a minimal GET request, they observe the Server: Vector header or a Vector-specific error response, confirming the presence of the service.
2. Trigger/Weaponization: Using a scripting tool (e.g., curl, h2load, or a custom Python script), the attacker constructs an HTTP/1.1 GET request with 10,000+ headers. Each header uses a name like X-Filler-0001-NNNN (where NNNN increments to keep name uniqueness) and a value string of 10KB of 'A' characters. The total request size is ~100MB.
3. Payload/Execution: The attacker sends the request to http://target:8686/api/v1/events (a typical Vector HTTP sink endpoint). The prelude module begins buffering and parsing the headers synchronously.
4. Post-exploitation Impact: The Vector process enters a near-100% CPU spin state and its resident memory grows to hundreds of megabytes. Log ingestion stops. Downstream systems (SIEM, dashboards) lose data. If the process OOM-kills, the entire Vector service crashes, potentially taking down the node if it is a systemd-managed critical service.

Scenario 2: Slowloris-Style Chunked Body

1. Reconnaissance: Attacker identifies a Vector instance fronted by a load balancer (port 8080). They verify the /health endpoint returns a Vector signature.
2. Trigger/Weaponization: The attacker opens a TCP connection and sends a POST /api/v1/events request with Transfer-Encoding: chunked and a first chunk header declaring 0xFFFFFFFF (4GB). They never send the chunk body.
3. Payload/Execution: The prelude module reserves memory for the declared chunk size and waits for the body. The connection remains open, consuming a file descriptor and socket buffer.
4. Post-exploitation Impact: By repeating this across thousands of connections, the attacker exhausts Vector's file descriptor limit (RLIMIT_NOFILE) and memory pool. The instance becomes unable to accept new connections, effectively taking the HTTP source offline.

Scenario 3: Persistent Disruption via Cron

An attacker who successfully lands a single exploitation event schedules the header-flood request every 30 seconds from a small botnet of 5 compromised hosts. Even if Vector survives one burst, recurring bursts prevent the system from recovering to a stable state between attacks, causing continuous service degradation over days.

Impact Assessment

CVSS Reference: Score N/A — no CVSS vector assigned by NVD at the time of this report. The vendor has not issued a severity rating. Based on similar HTTP-parser DoS issues (e.g., CVE-2023-44487), the vulnerability likely maps to a CVSSv3.1 base score of 7.5 (High) — AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H — due to unauthenticated network exploitation with high availability impact.

Business Impact: Vector is often deployed as the central aggregation point for all telemetry. A successful DoS results in:

• Loss of log, metric, and trace data for the duration of the attack.
• SIEM gap, failing compliance requirements (e.g., PCI-DSS log retention, SOC2 monitoring).
• False confidence in system health because alerts stop arriving.

Blast Radius: Exploitation affects the entire downstream pipeline. If Vector forwards to multiple outputs (Elasticsearch, Kafka, S3), all those destinations lose data flow. If Vector is deployed as a sidecar or daemonset on Kubernetes, the node's pod may restart repeatedly, triggering orchestration instability.

Availability: HIGH — resource exhaustion on the main process. Integrity: NONE — no data tampering. Confidentiality: NONE — no data exfiltration.

Detection Guidance

Sigma Rule

title: Datadog Vector HTTP Source - Excessive Headers DoS Attempt
id: 8f3f2d1e-6a8c-4b5e-9c2a-3f7e1d4b9c10
status: experimental
description: Detects HTTP requests with an abnormally high number of headers targeting Datadog Vector prelude endpoint
author: Valters IT Research
date: 2026/05/15
tags:
    - attack.t1499
    - attack.t1499.001
    - attack.t1499.002
logsource:
    category: webserver
    product: vector
detection:
    selection_header_count:
        # If Vector logs request metrics; adjust field name to environment
        cs_header_count: 
            - '>=5000'
    selection_body_length:
        cs_body_length: 
            - '>=100000000'  # 100MB requests
    condition: selection_header_count or selection_body_length
level: high
falsepositives:
    - Legitimate bulk uploads exceeding configured limits (rare)
    - Misconfigured agents sending malformed payloads

YARA Rule

rule CVE_2026_39197_Vector_Http_DoS
{
    meta:
        author      = "Valters IT Research"
        description = "Detect exploit signatures for Datadog Vector prelude DoS (CVE-2026-39197)"
        date        = "2026-05-15"
        references  = ["https://nvd.nist.gov/vuln/detail/CVE-2026-39197"]
        score       = 80

    strings:
        $s1 = "X-Filler-" ascii
        $s2 = "Transfer-Encoding: chunked" ascii nocase
        $s3 = "api/v1/events" ascii nocase
        $s4 = { 0x46 0x43 0x46 0x46 0x46 0x46 } // "FCFFFF" - part of oversized chunk size
        $s5 = /Content-Length:\s*[0-9]{10,}/ nocase  // header length >= 10 digits (1GB+)

    condition:
        // Signature for header-flood attack pattern
        (uint16(0) == 0x0d0a and $s1 and #s1 >= 500) or
        // Signature for chunked-body attack
        ($s2 and $s4) or
        // Generic huge Content-Length
        $s5
}

Suricata IDS Rule

alert http any any -> $VECTOR_SERVERS 8686,8080 (msg:"CVE-2026-39197 Datadog Vector HTTP prelude DoS attempt"; flow:to_server,established; content:"GET|20|/api/v1/events|20|HTTP/1.1|0d 0a|"; http_method; http_uri; http.request_line; http.header_names; http.header_names.length; threshold:type limit, track by_src, count 5, seconds 60; pcre:/^\s*$/R; reference:cve,CVE-2026-39197; classtype:attempted-dos; sid:1004097; rev:1;)

Alternatively, a rule using HTTP header count metadata:

alert http any any -> any 8686 (msg:"CVE-2026-39197 Vector DoS - Excessive headers (>5000)"; http.header_names; pcre:/(?:[^\r\n]+:\s*[^\r\n]*\r\n){5000,}/; flow:to_server; reference:cve,CVE-2026-39197; classtype:attempted-dos; sid:1004098; rev:1;)

Elastic Detection

// EQL search for web-server logs referencing Vector prelude path with large payloads
sequence by source.ip, destination.ip, process.name
  with maxspan=10m
  [ network where process.name == "vector" and destination.port in (8686, 8080)
      and network.protocol == "http"
      and length(http.request.body.bytes) > 100000000 ] // >100MB
  [ file where process.name == "vector"
      and file.size > 100000000 ] // memory buffering >100MB

Splunk SPL Query

index=op_syslog sourcetype=vector
| where like(_raw, "%/util/http/prelude%") OR like(_raw, "%http_source%")
| rex field=_raw "Content-Length:\s+(?<content_length>\d+)"
| rex field=_raw "X-Filler-[0-9]+" max_match=10000
| eval header_count = mvcount(mvdedup(_raw))  // crude estimate; prefer data_model node
| search content_length > 100000000 OR header_count > 1000
| stats count by src_ip, dest_ip, dest_port, _time
| sort - count

For netflow/network data:

index=netflow
| where dest_port IN (8686, 8080)
| eval avg_pkt_ratio = bytes / packets
| where bytes > 100000000 OR avg_pkt_ratio > 1400
| stats dc(flow_id) as flow_count, sum(bytes) as total_bytes by src_ip, dest_ip
| where flow_count > 50 or total_bytes > 500000000

Wazuh OSSEC Rule

<group name="vector,">
    <!-- Detect large HTTP POST/PUT requests to Vector HTTP source -->
    <rule id="100097" level="12">
        <decoded>json</decoded>
        <field name="event.module">http_source</field>
        <field name="http.request.body.bytes">+100000000</field>
        <description>CVE-2026-39197: Potential DoS - oversized request payload to Vector HTTP source</description>
        <group>attack.t1499,</group>
        <mitre>
            <id>T1499</id>
        </mitre>
    </rule>

    <!-- Detect massive header counts (Syslog/raw log capture) -->
    <rule id="100098" level="12">
        <match>X-Filler-</match>
        <regex>X-Filler-[0-9]+.{1,200}</regex>
        <frequency>500</frequency>
        <timeframe>60</timeframe>
        <description>CVE-2026-39197: Excessive HTTP headers from single source to Vector</description>
        <group>attack.t1499,</group>
        <mitre>
            <id>T1499</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

As of this report, Datadog has not released a patched version of Vector, and no official workaround is documented. The affected version is v0.54.0; there is no confirmed fixed version. Do not assume that upgrading to a later minor version resolves the issue unless vendor advisory confirms it.

Immediate Mitigations (while unpatched):

1. Disable the HTTP source if not strictly required for business operations. Instead, route data through a Unix socket or a separate TLS-authenticated transport.
2. Deploy a reverse proxy (Nginx, HAProxy, Caddy) in front of Vector that enforces:
   • client_max_body_size 10m (Nginx) or equivalent cap.
   • client_header_buffer_size and large_client_header_buffers set to low values (e.g., 4×8k).
   • Connection limits: limit_req_zone for rate-limiting requests per IP (e.g., 10 req/s).
3. Firewall ACL: Restrict access to the Vector HTTP port (8686/8080) to only known agent source IP ranges or SSO/identity-aware proxies.
4. Set OS-level resource limits (ulimit/systemd LimitNOFILE) to bound the process's file descriptors, preventing fd exhaustion from Slowloris variants, with watchdog auto-restart.
5. Monitor CPU/memory of the Vector process — alert on >80% sustained CPU or >2GB RSS.

Patch/Upgrade Steps:

1. Check for updates from Datadog in the official Vector release notes (https://vector.dev/releases/). Watch specifically for security fix release notes referencing CVE-2026-39197.
2. Run vector --version on all production instances to confirm exact version. If v0.54.0, assume vulnerable.
3. When a patched release (expected to be ≥ v0.55.0) is available, upgrade via the official installation method:
   • RedHat/CentOS: dnf update vector
   • Debian/Ubuntu: apt update && apt install vector
   • Docker: docker pull timberio/vector:latest (verify image digest, prefer pinned newer tags)
4. After upgrade, test HTTP source behavior with synthetic large requests in staging before production rollout.

Long-Term Hardening:

1. Configure Vector's http source with built-in limits once available (the vendor is expected to add max_request_body_size and header-count settings in the patch). Until then, rely on the reverse proxy.
2. Enforce API token authentication on all Vector HTTP sources even if internal — do not rely on network segmentation alone.
3. Implement a WAF (ModSecurity/CRS) in front of the proxy with a custom rule blocking requests with >1,000 headers or >50MB body.
4. Adopt a Zero-Trust architecture for observability pipelines — separate telemetry ingestion from management networks.
5. Subscrib e to the CISA KEV catalog; when this CVE is added, prioritize remediation to 2 weeks or less.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-39197 — Official NVD description and (forthcoming) CVSS metrics.
2. Datadog Vector Release History: https://vector.dev/releases/ — Monitor for vendor advisory and patched releases.
3. Datadog Vector GitHub Issue Tracker: https://github.com/vectordotdev/vector/issues — Track issue references to prelude.rs DoS fix.
4. CWE Server-Side Resource Exhaustion: https://cwe.mitre.org/data/definitions/770.html — Applicable vulnerability class baseline (CWE ID pending).
5. MITRE ATT&CK T1499 — Endpoint DoS: https://attack.mitre.org/techniques/T1499/ — Technique mapping for this exploitation pathway.

Threat Actor Campaign Evidence: None at the time of writing. EPSS score of 0.00289 (21.2 percentile) indicates low current exploitation likelihood in the wild; however, the lack of a patch combined with easy exploitation makes opportunistic scanning likely if this CVE gains further visibility. CISA KEV entry: No. PoC availability: Unknown.