EUVD-2026-62966
GHSA-9w75-cvch-h753
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
REST API is network-reachable without credentials (AV:N, PR:N), but AC:H because two independent conditions - crafted regex and matching event data - must both be met; impact is availability-only against the single connector.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API could configure timestamp extraction with a crafted regular expression and matching event data to block a Kafka Connect worker thread, stopping event delivery for the affected connector. The vulnerability is possible because timestamp extraction evaluates customer-supplied regular expressions without a time limit. For more information see Install Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/install/install-splunk-connect-for-kafka) and Data ingestion parameters for Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/overview/data-ingestion-parameters-for-splunk-connect-for-kafka) in the Splunk documentation.
AnalysisAI
Unauthenticated ReDoS in Splunk Connect for Kafka below version 2.2.7 allows a network-accessible attacker to permanently block a Kafka Connect worker thread by submitting a pathological regular expression via the Kafka Connect REST API, which - when triggered by attacker-supplied or coincident matching event data during timestamp extraction - causes the regex engine to backtrack catastrophically without bound. The practical result is complete stoppage of event delivery for the targeted connector, constituting a targeted denial-of-service against Splunk data ingestion pipelines. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Kafka Connect REST API must be reachable from the attacker's network position without requiring authentication - the CVSS PR:N confirms unauthenticated access to this API is the assumed condition. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately captures the risk profile: network-reachable and unauthenticated exploitation is possible, but AC:H acknowledges the dual precondition - the attacker must both submit a crafted regex and ensure matching event data flows through the connector. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access to an unprotected Kafka Connect REST API endpoint sends a PUT or POST request configuring a connector's timestamp extraction parameter with a ReDoS pattern such as a nested-quantifier regex. When Kafka event records matching the trigger string subsequently flow through the connector - either naturally from the topic or injected by the attacker - the regex engine enters catastrophic backtracking, permanently consuming the worker thread's CPU and halting all further record delivery from that connector without error recovery. … |
| Remediation | Upgrade Splunk Connect for Kafka to version 2.2.7 or later, which is confirmed by the vendor advisory SVD-2026-0808 (https://advisory.splunk.com/advisories/SVD-2026-0808) and the EUVD entry to resolve this vulnerability by imposing evaluation limits on customer-supplied regular expressions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same weakness CWE-407 – Inefficient Algorithmic Complexity
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today