Allocation of Resources Without Limits or Throttling in Splunk Enterprise - CVE-2026-76289
Published: October 22, 2026
Vulnerability identifier: #VU156973
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76289
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service by making the Splunk Enterprise instance unavailable to other users.
The vulnerability exists due to resource allocation without limits in the Splunk Enterprise REST API endpoint for lookup table files when processing response field selections. A remote user can send a specially crafted request specifying response fields to exhaust resources and make the instance unavailable.
Affected software
Splunk Enterprise
How to mitigate CVE-2026-76289
Install security update from vendor's website.
Splunk Enterprise - addressed in versions 9.4.16, 10.0.11, 10.2.8, 10.4.4