Description

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API and influence responses from a Hypertext Transfer Protocol (HTTP) Event Collector endpoint in Splunk Enterprise could cause the connector to retry failed event batches until event delivery stops. The vulnerability is possible because HTTP Event Collector delivery retry handling uses an unbounded default for failed batches instead of a finite retry limit. For more information see Install Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/install/install-splunk-connect-for-kafka), Data ingestion parameters for Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/overview/data-ingestion-parameters-for-splunk-connect-for-kafka), and Set up and use HTTP Event Collector with configuration files (https://help.splunk.com/en/splunk-enterprise/get-data-in/get-started-with-getting-data-in/9.4/get-data-with-http-event-collector/set-up-and-use-http-event-collector-with-configuration-files) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-19T22:17:26.647Z",
  "pubdate": "2026-08-19T22:17:26.647Z",
  "executiveSummary": "Splunk Connect for Kafka versions below 2.2.7 are affected by an unbounded retry denial of service vulnerability in the HTTP Event Collector delivery mechanism.\nThe vulnerability allows an unauthenticated remote attacker who can reach the Kafka Connect Representational State Transfer (REST) API and influence responses from a Hypertext Transfer Protocol (HTTP) Event Collector endpoint in Splunk Enterprise to cause the connector to infinitely retry failed event batches.\nThis behavior leads to the exhaustion of processing threads or blocking of event pipelines, ultimately resulting in a complete halt of event delivery to Splunk Enterprise.\nThe root cause stems from the implementation of an unbounded default for failed batch retries instead of a finite retry limit.\nExploitation requires network reachability to the Kafka Connect Representational State Transfer (REST) API and the ability to manipulate or spoof Hypertext Transfer Protocol (HTTP) responses from the Hypertext Transfer Protocol (HTTP) Event Collector endpoint.\nThe risk implications include operational disruption, data ingestion stalls, and potential loss of real-time telemetry processing capabilities.",
  "technicalDetails": "The vulnerability resides within the HTTP Event Collector delivery retry handling component of Splunk Connect for Kafka in versions below 2.2.7.\nThe underlying root cause is the lack of a finite retry limit coupled with the use of an unbounded default configuration for handling failed event batches.\nThe affected component is the HTTP Event Collector integration module within the Kafka Connect framework, which interfaces with Splunk Enterprise over Hypertext Transfer Protocol (HTTP).\nAuthentication and privilege requirements for initial trigger are low, as an unauthenticated user who possesses network reachability to the Kafka Connect Representational State Transfer (REST) API can interact with the ingestion pipeline.\nNetwork exposure is defined by the accessibility of the Kafka Connect Representational State Transfer (REST) API and the communication path between the connector and the Hypertext Transfer Protocol (HTTP) Event Collector endpoint.\nThe attack flow proceeds as follows: First, an attacker establishes network reachability to the Kafka Connect Representational State Transfer (REST) API. Second, the attacker influences or intercepts responses from the Hypertext Transfer Protocol (HTTP) Event Collector endpoint in Splunk Enterprise to return error codes or malformed data for transmitted event batches. Third, upon receiving the failure response, the Kafka Connect task initiates its retry sequence. Fourth, because the retry mechanism utilizes an unbounded default limit rather than a finite threshold, the connector continuously attempts to retransmit the failing event batch indefinitely. Finally, this infinite retry loop consumes execution resources, blocks subsequent data ingestion queues, and causes event delivery to permanently halt, resulting in a denial of service condition for the data pipeline."
}