CVE-2026-76271: An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached. in Splunk Splunk Enterprise

This vulnerability arises from an inefficient regular expression used in the Discover Splunk Observability Cloud app within Splunk Enterprise. When a low-privileged user submits crafted input to a REST API endpoint, the worst-case computational complexity of the regex can be triggered, causing a denial of service. The issue affects Splunk Enterprise versions >=10.0.0 <10.0.10, >=10.2.0 <10.2.7, and >=10.4.0 <10.4.3. Versions 9.4.x are confirmed not vulnerable.

An attacker with low privileges (not requiring admin or power roles) can cause a denial of service by triggering the inefficient regular expression, resulting in degraded system performance or unavailability of the affected REST API endpoint. There is no impact on confidentiality or integrity.

Splunk Enterprise versions 10.0.10, 10.2.7, and 10.4.3 or later include fixes for this vulnerability. Users should upgrade to these or later versions to remediate the issue. No other mitigation or workaround is specified. Since this is not a cloud service, remediation depends on applying the vendor's official fixes.