In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API and influence responses from a Hypertext Transfer Protocol (HTTP) Event Collector endpoint in Splunk Enterprise could cause the connector to retry failed event batches until event delivery stops. The vulnerability is possible because HTTP Event Collector delivery retry handling uses an unbounded default for failed batches instead of a finite retry limit. For more information see Install Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/install/install-splunk-connect-for-kafka), Data ingestion parameters for Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/overview/data-ingestion-parameters-for-splunk-connect-for-kafka), and Set up and use HTTP Event Collector with configuration files (https://help.splunk.com/en/splunk-enterprise/get-data-in/get-started-with-getting-data-in/9.4/get-data-with-http-event-collector/set-up-and-use-http-event-collector-with-configuration-files) in the Splunk documentation.
References
| Link | Resource |
|---|---|
| https://advisory.splunk.com/advisories/SVD-2026-0808 | Vendor Advisory |
Configurations
History
No history.
Information
Published : 2026-08-19 22:17
Updated : 2026-08-24 19:03
NVD link : CVE-2026-76400
Mitre link : CVE-2026-76400
CVE.ORG link : CVE-2026-76400
JSON object : View
Products Affected
splunk
- connect_for_kafka
CWE
CWE-400
Uncontrolled Resource Consumption