CVE-2024-22164: Splunk Enterprise Security (ES) · The software does not properly control the allocation and maintenance of a limited resource thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Affects Splunk Enterprise Security (ES)Source CVE Database V5
Not known to be exploited · CVSS 4.3 Medium.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 39% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LExploitation evidence
Disclosed: evidence found.
CVE published 9 Jan 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Splunk Splunk Enterprise Security (ES) | Affected
| Fixed in– |
AI-suggested
To mitigate this vulnerability, European organizations should: 1) Monitor Splunk ES usage and logs for unusually large or malformed requests to the investigation attachment endpoint, which could indicate exploitation attempts. 2) Implement network-level protections such as rate limiting, web application firewalls (WAFs), or intrusion prevention systems (IPS) to detect and block excessive or anomalous traffic targeting Splunk ES endpoints. 3) Restrict access to the Splunk ES Investigation feature to trusted users and networks, minimizing exposure to untrusted actors. 4) Apply the principle of least privilege by ensuring that only necessary users have permissions to upload or interact with investigation attachments. 5) Stay informed about official patches or updates from Splunk and prioritize timely deployment once available. 6) Consider deploying resource usage monitoring and alerting on Splunk servers to detect early signs of resource exhaustion. 7) If possible, isolate Splunk ES instances in segmented network zones to limit the blast radius of potential DoS attacks. These steps go beyond generic advice by focusing on proactive detection, access control, and network-level defenses tailored to the nature of this vulnerability.
Description
In Splunk Enterprise Security (ES) versions below 7.1.2, an attacker can use investigation attachments to perform a denial of service (DoS) to the Investigation. The attachment endpoint does not properly limit the size of the request which lets an attacker cause the Investigation to become inaccessible.