CVE-2026-76288: Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterprise

Q: What access does an attacker need to trigger the issue?

An attacker does not need authentication, privileges, or user interaction. A single crafted request to the Splunk Web JavaScript logger endpoint can trigger the denial of service.

Q: What is the operational impact if exploitation succeeds?

Splunk Web stops responding to requests. It remains unavailable until Splunk Enterprise is restarted.

Q: What configuration condition enables the vulnerability?

The issue is caused by Splunk Web not limiting request-header parsing before processing the request. No separate non-default configuration requirement is identified.

Published Oct 21, 2026

Updated

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarted. The vulnerability is possible because Splunk Web does not limit request-header parsing before processing the request.

Affected Software

1 affected component

Splunk Splunk Enterprise<10.4.4, <10.2.8, <10.0.11, <9.4.16

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Splunk Enterprise to a version that resolves this vulnerability.
Fixed in 10.4.4
Upgrade
Upgrade Splunk Enterprise to a version that resolves this vulnerability.
Fixed in 10.2.8
Upgrade
Upgrade Splunk Enterprise to a version that resolves this vulnerability.
Fixed in 10.0.11
Upgrade
Upgrade Splunk Enterprise to a version that resolves this vulnerability.
Fixed in 9.4.16

Event History

Oct 21, 2026

CVE Published

via MITRE·10:51 PM

Data Sourced

via MITRE·10:51 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16 are affected. The issue impacts Splunk Web.

What access does an attacker need to trigger the issue?

An attacker does not need authentication, privileges, or user interaction. A single crafted request to the Splunk Web JavaScript logger endpoint can trigger the denial of service.

What is the operational impact if exploitation succeeds?

Splunk Web stops responding to requests. It remains unavailable until Splunk Enterprise is restarted.

What configuration condition enables the vulnerability?

The issue is caused by Splunk Web not limiting request-header parsing before processing the request. No separate non-default configuration requirement is identified.

CVE-2026-76288: Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterprise

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to trigger the issue?

What is the operational impact if exploitation succeeds?

What configuration condition enables the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to trigger the issue?

What is the operational impact if exploitation succeeds?

What configuration condition enables the vulnerability?