CVE-2026-76290: The software does not properly control the allocation and maintenance of a limited resource thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise, the Edge Processor package download endpoint accepts unauthenticated requests and processes each by reading and base64-encoding the entire package in memory. This improper control of resource allocation allows an unauthenticated actor to send repeated requests that consume excessive system resources, leading to denial of service by exhausting available resources. The vulnerability affects versions >=10.0 <10.0.11, >=10.2 <10.2.8, and >=10.4 <10.4.4. The vendor recommends upgrading to fixed versions, enabling authentication for Edge Processor package downloads, and restarting Splunk Enterprise to mitigate the issue.

An unauthenticated attacker can cause a denial of service condition by exhausting system resources on the Splunk Enterprise server, potentially causing the Splunk daemon to stop responding. There is no impact on confidentiality or integrity according to the CVSS vector; the impact is limited to availability.

A fix is available by upgrading to Splunk Enterprise versions 10.4.4 or later, 10.2.8 or later, and 10.0.11 or later. After upgrading, administrators should prepare existing Edge Processor instances, enable authentication for Edge Processor package downloads as documented by Splunk, and restart the Splunk Enterprise service. These steps mitigate the vulnerability by preventing unauthenticated access to the package download endpoint and controlling resource consumption.