Splunk Enterprise <10.4.4 DoS via Malicious JS Logger Request
CVE-2026-76288 Published on October 21, 2026
Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterprise
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarted.
The vulnerability is possible because Splunk Web does not limit request-header parsing before processing the request.
Weakness Type
What is a Resource Exhaustion Vulnerability?
The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVE-2026-76288 has been classified to as a Resource Exhaustion vulnerability or weakness.
Products Associated with CVE-2026-76288
Want to know whenever a new CVE is published for Splunk? stack.watch will email you.
Affected Versions
Splunk Enterprise:- Version 10.4 and below 10.4.4 is affected.
- Version 10.2 and below 10.2.8 is affected.
- Version 10.0 and below 10.0.11 is affected.
- Version 9.4 and below 9.4.16 is affected.