The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index Universal Forwarder traffic. The vulnerability impacts Splunk Enterprise versions before 7.3.9, 8.0 versions before 8.0.9, and 8.1 versions before 8.1.3. It does not impact Universal Forwarders. When Splunk forwarding is secured using TLS or a Token, the attack requires compromising the certificate or token, or both. Implementation of either or both reduces the severity to Medium.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Splunk | — | Upgrade Splunk Enterprise to version 7.3.9Upgrade Splunk Enterprise to version 8.1.3Upgrade Splunk Enterprise to version 8.0.9 | Apr 7, 2025 | Mar 24, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub