CVE-2026-76400: Denial of Service (DoS) through the REST API in Splunk Connect for Kafka
In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API and influence responses from a Hypertext Transfer Protocol (HTTP) Event Collector endpoint in Splunk Enterprise could cause the connector to retry failed event batches until event delivery stops. The vulnerability is possible because HTTP Event Collector delivery retry handling uses an unbounded default for failed batches instead of a finite retry limit. For more information see Install Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/install/install-splunk-connect-for-kafka), Data ingestion parameters for Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/overview/data-ingestion-parameters-for-splunk-connect-for-kafka), and Set up and use HTTP Event Collector with configuration files (https://help.splunk.com/en/splunk-enterprise/get-data-in/get-started-with-getting-data-in/9.4/get-data-with-http-event-collector/set-up-and-use-http-event-collector-with-configuration-files) in the Splunk documentation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk Connect for Kafkato a version that resolves this vulnerability.Fixed in 2.2.7
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running Splunk Connect for Kafka below 2.2.7 are exposed if an unauthenticated user can reach the Kafka Connect REST API and can influence responses from a Splunk Enterprise HTTP Event Collector endpoint.
What must an attacker do to disrupt event delivery?
The attacker needs network access to the Kafka Connect REST API and the ability to influence HTTP Event Collector responses. They can cause failed event batches to be retried indefinitely, eventually stopping event delivery.
Why can failed batches cause a denial of service?
The HTTP Event Collector delivery retry handling uses an unbounded default retry setting for failed batches rather than a finite retry limit. Repeated failures can therefore keep the connector retrying until delivery stops.