# CVE-2026-76400: Denial of Service (DoS) through the REST API in Splunk Connect for Kafka

> CVE-2026-76400: Denial of Service (DoS) through the REST API in Splunk Connect for Kafka. CVSS 5.9 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-76400
Last updated: 2026-08-24T19:03:38Z

- Published: 2026-08-19 21:35 UTC · Updated: 2026-08-24 19:03 UTC · Assigner: cisco
- CVSS: 5.9 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS: 0.38%, 32th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-400

## Description

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API and influence responses from a Hypertext Transfer Protocol (HTTP) Event Collector endpoint in Splunk Enterprise could cause the connector to retry failed event batches until event delivery stops. The vulnerability is possible because HTTP Event Collector delivery retry handling uses an unbounded default for failed batches instead of a finite retry limit. For more information see Install Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/install/install-splunk-connect-for-kafka), Data ingestion parameters for Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/overview/data-ingestion-parameters-for-splunk-connect-for-kafka), and Set up and use HTTP Event Collector with configuration files (https://help.splunk.com/en/splunk-enterprise/get-data-in/get-started-with-getting-data-in/9.4/get-data-with-http-event-collector/set-up-and-use-http-event-collector-with-configuration-files) in the Splunk documentation.

## Affected vendors and products

- Splunk: Splunk Connect for Kafka

## Tracked companies

- [Splunk](https://rewindex.com/company/splunk.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-76400)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-76400)
- [https://advisory.splunk.com/advisories/SVD-2026-0808](https://advisory.splunk.com/advisories/SVD-2026-0808)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-76400 · Markdown: https://rewindex.com/cve/CVE-2026-76400.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-76400 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T04:06:11.956Z