CVE-2026-76288
Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterprise
HIGH 7.5
At a glance
- Source
- NVD
- EPSS
- EPSS 0.47 % · percentile 41 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- cisco
- NVD status
- Undergoing Analysis
Description
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarted. The vulnerability is possible because Splunk Web does not limit request-header parsing before processing the request.
Weaknesses (CWE)
- CWE-400 — Uncontrolled Resource Consumption
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | cisco |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · psirt@cisco.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-107663
- GCVE · GCVE-0-2026-76288
CERT-FR advisories
- CERTFR-2026-AVI-1366 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Splunk · Splunk Enterprise | affected 10.4 < 10.4.4 ; affected 10.2 < 10.2.8 ; affected 10.0 < 10.0.11 ; affected 9.4 < 9.4.16 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |