{"record":{"id":"ea9a25ea00d9e825","repo":"vectordotdev/vector","slug":"invalid-timestamp-ea9a25","errorCode":null,"errorMessage":"invalid timestamp","messagePattern":"invalid timestamp","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src/sources/splunk_hec/mod.rs","lineNumber":1042,"sourceCode":"        };\n\n        match parsed_time {\n            None => Ok(()),\n            Some(Some(t)) => {\n                if let Some(t) = t.as_u64() {\n                    let time = parse_timestamp(t as i64).ok_or(ApiError::InvalidDataFormat {\n                        event: self.envelopes_processed.saturating_sub(1),\n                    })?;\n                    self.time = Time::Provided(time);\n                    Ok(())\n                } else if let Some(t) = t.as_f64() {\n                    self.time = Time::Provided(\n                        Utc.timestamp_opt(\n                            t.floor() as i64,\n                            (t.fract() * 1000.0 * 1000.0 * 1000.0) as u32,\n                        )\n                        .single()\n                        .expect(\"invalid timestamp\"),\n                    );\n                    Ok(())\n                } else {\n                    Err(ApiError::InvalidDataFormat {\n                        event: self.envelopes_processed.saturating_sub(1),\n                    }\n                    .into())\n                }\n            }\n            Some(None) => Err(ApiError::InvalidDataFormat {\n                event: self.envelopes_processed.saturating_sub(1),\n            }\n            .into()),\n        }\n    }\n\n    fn build_event(&mut self, mut json: JsonValue) -> Result<Event, Rejection> {\n        self.envelopes_processed += 1;","sourceCodeStart":1024,"sourceCodeEnd":1060,"githubUrl":"https://github.com/vectordotdev/vector/blob/3708c39b12a93212ed8b8d7510b4cc7769cb5864/src/sources/splunk_hec/mod.rs#L1024-L1060","documentation":"Splunk HEC events accept a numeric `time` field. When it is a float, Vector converts to seconds+nanos and calls `Utc.timestamp_opt(...).single().expect(\"invalid timestamp\")` (src/sources/splunk_hec/mod.rs:1042). chrono only supports roughly years -262144..+262143 (|seconds| < ~8.3e12); outside that range `timestamp_opt` returns `LocalResult::None`, `.single()` yields None, and the HEC source task panics — a single malformed request can take down the source.","triggerScenarios":"A client POSTing to /services/collector/event with `time` as nanoseconds (~1.7e18), microseconds (~1.7e15), or a formatted number like 20240101120000 (~2.0e13) — all beyond chrono's range; also `time: Infinity` (float-to-int saturates to i64::MAX, out of range).","commonSituations":"Apps that assume ms/µs/ns units instead of HEC's expected (fractional) epoch seconds; test harnesses posting literal YYYYMMDDHHMMSS numbers; any internet-reachable unauthenticated HEC endpoint, which turns this into a remote crash/DoS vector.","solutions":["Fix the sender: `time` must be epoch seconds (float allowed), or omit it so Splunk/Vector fills it in","Front the HEC endpoint with a validating proxy that rejects |time| beyond ~8.3e12","Upgrade Vector / patch the source to bound-check and return ApiError::InvalidDataFormat instead of panicking"],"exampleFix":"// before\nUtc.timestamp_opt(\n    t.floor() as i64,\n    (t.fract() * 1000.0 * 1000.0 * 1000.0) as u32,\n)\n.single()\n.expect(\"invalid timestamp\")\n// after\nUtc.timestamp_opt(\n    t.floor() as i64,\n    (t.fract() * 1000.0 * 1000.0 * 1000.0) as u32,\n)\n.single()\n.ok_or(ApiError::InvalidDataFormat {\n    event: self.envelopes_processed.saturating_sub(1),\n})?","handlingStrategy":"validation","validationCode":"# sender-side (Python): HEC `time` must be epoch seconds within chrono's range\nimport math\nVALID = isinstance(t, (int, float)) and math.isfinite(t) and abs(t) < 8.3e12\nif not VALID:\n    t = time.time()  # or omit the field","typeGuard":"def valid_hec_time(t) -> bool:\n    return isinstance(t, (int, float)) and math.isfinite(t) and abs(t) < 8.3e12","tryCatchPattern":null,"preventionTips":["Send HEC time as fractional epoch seconds only; never ms/µs/ns or YYYYMMDDHHMMSS","Omit `time` and let the receiver stamp it when in doubt","Place a schema-validating proxy (or Vector's own http source + remap guard) in front of exposed HEC endpoints","Upgrade Vector once a release bounds-checks `time` instead of panicking"],"tags":["splunk-hec","timestamp","chrono","dos","panic"],"backgroundTag":"timestamp-out-of-range","analyzedSha":"3708c39b12a93212ed8b8d7510b4cc7769cb5864","analyzedAt":"2026-08-20T07:02:18.786Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}