CVE-2026-76288 - Vulnerability Details - OpenCVE

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarted. The vulnerability is possible because Splunk Web does not limit request-header parsing before processing the request.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Splunk	Splunk Enterprise

No data.

No data.

References

Link	Providers
https://advisory.splunk.com/advisories/SVD-2026-1007

History

Thu, 22 Oct 2026 14:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 22 Oct 2026 05:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Splunk Splunk splunk Enterprise
Vendors & Products		Splunk Splunk splunk Enterprise

Wed, 21 Oct 2026 23:00:00 +0000

Type	Values Removed	Values Added
Description		In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarted. The vulnerability is possible because Splunk Web does not limit request-header parsing before processing the request.
Title		Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterprise
Weaknesses		CWE-400
References		https://advisory.splunk.com/advisories/SVD-2026-1007
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

MITRE

Status: PUBLISHED

Assigner: cisco

Published: 2026-10-21T22:51:50.487Z

Updated: 2026-10-22T13:37:48.847Z

Reserved: 2026-08-19T12:02:03.622Z

Link: CVE-2026-76288

Vulnrichment

Updated: 2026-10-22T13:34:12.166Z

NVD

Status : Awaiting Analysis

Published: 2026-10-21T23:17:26.537

Modified: 2026-10-22T16:57:10.180

Link: CVE-2026-76288

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-76288", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2026-08-19T12:02:03.622Z", "datePublished": "2026-10-21T22:51:50.487Z", "dateUpdated": "2026-10-22T13:37:48.847Z"}, "containers": {"cna": {"affected": [{"product": "Splunk Enterprise", "vendor": "Splunk", "versions": [{"version": "10.4", "status": "affected", "versionType": "custom", "lessThan": "10.4.4"}, {"version": "10.2", "status": "affected", "versionType": "custom", "lessThan": "10.2.8"}, {"version": "10.0", "status": "affected", "versionType": "custom", "lessThan": "10.0.11"}, {"version": "9.4", "status": "affected", "versionType": "custom", "lessThan": "9.4.16"}], "modules": ["Splunk Web"]}], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarted.\nThe vulnerability is possible because Splunk Web does not limit request-header parsing before processing the request."}], "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2026-1007"}], "title": "Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterprise", "datePublic": "2026-10-21T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-400", "description": "The software does not properly control the allocation and maintenance of a limited resource thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources."}]}], "source": {"advisory": "SVD-2026-1007", "discovery": ""}, "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-10-21T22:51:50.487Z"}, "metrics": [{"cvssV3_1": {"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "solutions": [{"lang": "en", "value": "Upgrade Splunk Enterprise to versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16 or higher."}], "workarounds": [{"lang": "en", "value": "The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround.\nSee [Disable unnecessary Splunk Enterprise components](https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/install-splunk-enterprise-securely/disable-unnecessary-splunk-enterprise-components) and the [web.conf](https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.1-configuration-file-reference/web.conf) configuration specification file for more information on turning off Splunk Web."}], "credits": [{"lang": "en", "value": "Pedro Cardoso (tvmpt)"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-76288", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-22T13:20:16.974939Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-22T13:37:48.847Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-76288", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-22T13:20:16.974939Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-22T13:34:12.166Z"}}], "cna": {"title": "Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterprise", "source": {"advisory": "SVD-2026-1007", "discovery": ""}, "credits": [{"lang": "en", "value": "Pedro Cardoso (tvmpt)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Splunk", "modules": ["Splunk Web"], "product": "Splunk Enterprise", "versions": [{"status": "affected", "version": "10.4", "lessThan": "10.4.4", "versionType": "custom"}, {"status": "affected", "version": "10.2", "lessThan": "10.2.8", "versionType": "custom"}, {"status": "affected", "version": "10.0", "lessThan": "10.0.11", "versionType": "custom"}, {"status": "affected", "version": "9.4", "lessThan": "9.4.16", "versionType": "custom"}]}], "solutions": [{"lang": "en", "value": "Upgrade Splunk Enterprise to versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16 or higher."}], "datePublic": "2026-10-21T00:00:00.000Z", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2026-1007"}], "workarounds": [{"lang": "en", "value": "The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround.\nSee [Disable unnecessary Splunk Enterprise components](https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/install-splunk-enterprise-securely/disable-unnecessary-splunk-enterprise-components) and the [web.conf](https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.1-configuration-file-reference/web.conf) configuration specification file for more information on turning off Splunk Web."}], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarted.\nThe vulnerability is possible because Splunk Web does not limit request-header parsing before processing the request."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-400", "description": "The software does not properly control the allocation and maintenance of a limited resource thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources."}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-10-21T22:51:50.487Z"}}}, "cveMetadata": {"cveId": "CVE-2026-76288", "state": "PUBLISHED", "dateUpdated": "2026-10-22T13:37:48.847Z", "dateReserved": "2026-08-19T12:02:03.622Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2026-10-21T22:51:50.487Z", "assignerShortName": "cisco"}, "dataVersion": "5.2"}