All vulnerabilities
CVE-2026-76288

Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterprise

Splunk Splunk EnterpriseApplications & CMS
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.37%Chance of exploitation activity in the next 30 days, higher than 29% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in10.4.4Also 10.2.8, 10.0.11 and 1 moreCVE List
Published21 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarted. The vulnerability is possible because Splunk Web does not limit request-header parsing before processing the request.

Text from CVE List

Affected versions 4

  • Splunk Enterpriseaffected: 10.4 before 10.4.4CVE List
  • Splunk Enterpriseaffected: 10.2 before 10.2.8CVE List
  • Splunk Enterpriseaffected: 10.0 before 10.0.11CVE List
  • Splunk Enterpriseaffected: 9.4 before 9.4.16CVE List

References 1