CVE-2026-76401: An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached. in Splunk Splunk Connect for Kafka

In Splunk Connect for Kafka versions 2.2 and >=2.2 <2.2.7, an unauthenticated user with access to the Kafka Connect REST API can supply a crafted regular expression for timestamp extraction. Because the evaluation of these regular expressions has no time limit, the worst-case computational complexity can be triggered, causing a Kafka Connect worker thread to block and halting event delivery for the affected connector. This denial of service condition arises from inefficient algorithmic behavior when processing the crafted input.

The vulnerability results in denial of service by blocking a Kafka Connect worker thread, which stops event delivery for the affected connector. There is no impact on confidentiality or integrity. The attack requires network access to the Kafka Connect REST API and high attack complexity due to the need for crafted regular expressions. No known exploits are reported in the wild.

No explicit patch or remediation is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict unauthenticated access to the Kafka Connect REST API to trusted users only and avoid using untrusted regular expressions for timestamp extraction.