`syslog` source silently drops RFC 5424 messages whose HOSTNAME is an IPv6 address ending in `::`

A note for the community

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Problem

Follow-up to #19042: the syslog-loose fix (StephenWakely/syslog-loose#27, shipped in #19143) covered IPv6 hostnames with interior colons, but hostnames whose canonical RFC 5952 form ends in a bare :: (all-zero host tail, e.g. 2600:1f14:247e:5804:29e3::, fe80::) are still rejected — the crate's trailing-colon RFC 3164 separator heuristic splits the final colon and breaks the RFC 5424 field layout.

Result in the syslog source: Failed deserializing frame. error=unable to parse input as valid syslog message (component_errors_total{error_code="decoder_deserialize"}), the frame is silently dropped, and the connection stays open.

Real-world impact: in IPv6 Kubernetes (EKS) clusters where an upstream syslog-ng relay writes the peer IP into HOST (its keep-hostname(no) default), any sender allocated a zero-tail address suffers sustained 100% log loss until it gets a different IP. Because roughly one address per allocation block has this text form, it presents as random, per-node, total log blackouts — this took us weeks to root-cause.

Upstream report with a minimal deterministic repro (crate pinned to 0.23.0, the version vendored by current Vector): StephenWakely/syslog-loose#52. Filing here for visibility and to track the dependency bump once it's fixed upstream.

Per RFC 5424 §6.2.4 HOSTNAME may be an IPv6 address in its RFC 4291/5952 textual form, so the rejected messages are spec-conformant.

Configuration

sources:
  syslog:
    type: syslog
    address: "[::]:601"
    mode: tcp

Version

vector 0.57.0 (syslog_loose 0.23.0)

Debug Output

ERROR source{component_kind="source" component_id=syslog component_type=syslog}:connection{peer_addr=...}: vector::internal_events::codecs: Failed deserializing frame. error=unable to parse input as valid syslog message error_type="parser_failed" stage="processing"

Example Data

<14>1 2026-08-13T08:00:00.000+00:00 2600:1f14:247e:5804:29e3:: app - - - hello world

The same message parses fine with any interior-colon hostname (::1, 2600:1f14:247e:5804:29e3::3); only the trailing-:: rendering fails.

Additional Context

Vector is running in Kubernetes behind a syslog-ng relay.

References

• #19042
• StephenWakely/syslog-loose#52

Start with the syslog source and the upstream syslog-loose#52 report, then reproduce the failure using the RFC 5424 example and the current syslog_loose 0.23.0 dependency. The work is complete when the dependency fix is available, Vector is bumped to it, and the trailing-:: HOSTNAME message no longer produces a decoder_deserialize error or drops the frame.