An unauthenticated user can send a single crafted HTTP request to the Splunk Web JavaScript logger endpoint. The flaw lies in Splunk Web’s lack of limits on request‑header parsing, which can cause the web component to cease responding to further requests until the entire Splunk Enterprise instance is restarted. This represents a classic unbounded input vulnerability, identified as CWE‑400, and results in a denial of service that can affect the availability of the web interface for all users.

Splunk Enterprise installations running any version earlier than 10.4.4, 10.2.8, 10.0.11, or 9.4.16 are susceptible. The vulnerability is only triggered when Splunk Web is enabled.

The CVSS score of 7.5 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying there are no reported large‑scale exploitation incidents yet. An unauthenticated attacker can send a crafted HTTP request to the JavaScript logger endpoint, which causes the web component to stop responding until a full restart of Splunk Enterprise is performed. The impact is a denial of service that affects all users of the web interface.