The vulnerability allows a user without admin or power roles to issue a request to the REST API endpoint that handles lookup table files. Because the endpoint does not restrict resource usage based on response field selections, repeated or crafted requests can exhaust the instance’s resources, resulting in a service outage for all users. This denial of service disables normal Splunk operations until the instance is restarted.

The affected product is Splunk Enterprise. Versions prior to 10.4.4, 10.2.8, 10.0.11, and 9.4.16 are impacted. Only users lacking higher privileged roles can trigger the issue. Administrators should ensure that their installation is updated beyond these thresholds.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is not available while the vulnerability is not in the CISA KEV catalog. The likely attack vector is an authenticated user with a limited role sending API requests. Because the flaw is exploitable without special privileges beyond normal user access, an insider or compromised account could cause a DoS, potentially impacting availability for the broader user base. Patched versions mitigate the flaw by limiting resource usage.