In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web

Summary

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarted. The vulnerability is possible because Splunk Web does not limit request-header parsing before processing the request.

Remediation

1. Inventory every Splunk Splunk deployment, including staging.
2. Upgrade Splunk Splunk to the fixed version for your release line, listed under Affected versions.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://advisory.splunk.com/advisories/SVD-2026-1007