CVE-2026-76401: Regular Expression Denial of Service (DoS) through the REST API in Splunk Connect for Kafka
In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API could configure timestamp extraction with a crafted regular expression and matching event data to block a Kafka Connect worker thread, stopping event delivery for the affected connector. The vulnerability is possible because timestamp extraction evaluates customer-supplied regular expressions without a time limit. For more information see Install Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/install/install-splunk-connect-for-kafka) and Data ingestion parameters for Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/overview/data-ingestion-parameters-for-splunk-connect-for-kafka) in the Splunk documentation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk Connect for Kafkato a version that resolves this vulnerability.Fixed in 2.2.7
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Splunk Connect for Kafka versions below 2.2.7 are exposed if an unauthenticated user can reach the Kafka Connect REST API. The affected behavior is timestamp extraction for a connector.
What does an attacker need to do to disrupt event delivery?
The attacker needs network access to the Kafka Connect REST API and must be able to configure timestamp extraction with a crafted regular expression and matching event data. Exploitation can block a Kafka Connect worker thread and stop event delivery for the affected connector.
What can be done if upgrading is not immediately possible?
Restrict unauthenticated access to the Kafka Connect REST API so untrusted users cannot reach it or configure timestamp extraction. This addresses the access condition described for exploitation.