CVE-2026-76288

{
  "etk_id": "ETK-2026-2370",
  "cve_id": "CVE-2026-76288",
  "display_id": "CVE-2026-76288",
  "ghsa_id": null,
  "euvd_id": null,
  "status": "in_pipeline",
  "anchor_state": "anchored",
  "title": "Unauthenticated header parsing denial of service in Splunk Enterprise",
  "summary": "Splunk Enterprise releases before 10.4.4, 10.2.8, 10.0.11, and 9.4.16 are affected. An unauthenticated remote attacker able to reach the Splunk Web JavaScript logging endpoint can cause the web interface to stop serving requests; recovery requires restarting Splunk Enterprise.",
  "mitigation": "Upgrade Splunk Enterprise to 10.4.4, 10.2.8, 10.0.11, or 9.4.16, as appropriate for the supported release train. Until upgraded, restrict untrusted network access to Splunk Web.",
  "vendor": "Splunk",
  "product": "Splunk Enterprise",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 10.4, < 10.4.4",
        ">= 10.2, < 10.2.8",
        ">= 10.0, < 10.0.11",
        ">= 9.4, < 9.4.16"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "10.4.4",
        "10.2.8",
        "10.0.11",
        "9.4.16"
      ],
      "package_name": "Splunk Enterprise",
      "purl": null
    }
  ],
  "cwes": [
    400
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": null,
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": null,
  "t0_at": "2026-10-21T22:51:50.487000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-21T22:51:50.487000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-21T22:51:50.487000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76288"
    }
  }
}