The vulnerability allows an unauthenticated user to repeatedly hit the Edge Processor package download endpoint in the Splunk Pipeline Builders app, causing the Splunk daemon to read and base64‑encode entire packages in memory for each request. This results in excessive consumption of system resources and can make the daemon stop responding, which is a classic resource exhaustion flaw identified as CWE‑400.

Splunk Enterprise appliances running any version below 10.4.4, 10.2.8, or 10.0.11 are impacted. The flaw resides in the Splunk Pipeline Builders app, specifically the Edge Processor package download API used by Edge Processor instances.

With a CVSS score of 7.5 the vulnerability is considered moderate‑to‑high severity, but its EPSS score is not available and it is not listed in the CISA KEV catalog. The attack vector is unauthenticated over the REST API, meaning anyone with network access to the Splunk instance can trigger the flaw. Successful exploitation will degrade availability by exhausting memory and CPU resources, potentially leading to a denial of service of the Splunk daemon. The risk is especially acute in environments where the Pipeline Builders app and Edge Processor use cases are enabled and the endpoint is exposed to external traffic.