CVE-2026-76289: The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. in Splunk Splunk Enterprise

This vulnerability arises because the REST API endpoint handling lookup table files in affected Splunk Enterprise versions does not impose limits on the size or number of resources allocated when processing response field selections. As a result, users with roles below admin or power can exhaust resources, leading to denial of service that disrupts availability until the instance is restarted.

The vulnerability allows users with limited privileges to cause a denial of service by making the Splunk Enterprise instance unavailable to other users. There is no impact on confidentiality or integrity, but availability is severely affected, requiring a restart of the instance to restore service.

Splunk has released fixed versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16 that address this issue. Users should upgrade to these or later versions to remediate the vulnerability. No other mitigations are indicated in the vendor documentation.