CVE-2026-76400: The software does not properly control the allocation and maintenance of a limited resource thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. in Splunk Splunk Connect for Kafka

In Splunk Connect for Kafka versions >=2.2 and <2.2.7, the HTTP Event Collector delivery retry mechanism lacks a finite retry limit, resulting in unbounded retries of failed event batches. An unauthenticated actor with access to the Kafka Connect REST API and the ability to influence HTTP Event Collector endpoint responses can exploit this to cause resource exhaustion by forcing continuous retries until event delivery halts.

The vulnerability can cause resource exhaustion on the affected system due to unbounded retry attempts of failed event batches. This leads to denial of service (availability impact) without compromising confidentiality or integrity. No authentication is required to exploit this, but the attacker must be able to reach the Kafka Connect REST API and influence HTTP Event Collector responses.

A fix is available in Splunk Connect for Kafka version 2.2.7. Users should upgrade to version 2.2.7 or later to address this issue. Until then, restricting access to the Kafka Connect REST API and controlling HTTP Event Collector endpoint responses can help mitigate exploitation risk.