Description

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API could configure timestamp extraction with a crafted regular expression and matching event data to block a Kafka Connect worker thread, stopping event delivery for the affected connector. The vulnerability is possible because timestamp extraction evaluates customer-supplied regular expressions without a time limit. For more information see Install Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/install/install-splunk-connect-for-kafka) and Data ingestion parameters for Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/overview/data-ingestion-parameters-for-splunk-connect-for-kafka) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-19T22:17:26.780Z",
  "pubdate": "2026-08-19T22:17:26.780Z",
  "executiveSummary": "Splunk Connect for Kafka versions below 2.2.7 are affected by a Denial of Service vulnerability arising from the insecure evaluation of customer-supplied regular expressions during timestamp extraction.\nThe vulnerability allows an unauthenticated attacker who can reach the Kafka Connect Representational State Transfer (REST) API to supply a crafted regular expression along with matching event data.\nThis input triggers catastrophic backtracking or excessive processing time within the regex evaluation engine without any enforced time limits.\nThe resulting impact is the blockage of a Kafka Connect worker thread, which effectively halts event delivery for the affected connector and disrupts data ingestion pipelines.\nExploitation requires network access to the Kafka Connect REST API and the ability to configure or submit crafted timestamp extraction parameters, but does not require prior authentication or privileged access.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of execution time limits or complexity validation when evaluating customer-supplied regular expressions for timestamp extraction within Splunk Connect for Kafka.\nThe affected component is the timestamp extraction functionality exposed via the Kafka Connect Representational State Transfer (REST) API.\nAffected software versions include all deployments of Splunk Connect for Kafka below version 2.2.7.\nThe attack vector is network-based, requiring the threat actor to have network reachability to the Kafka Connect REST API endpoint.\nAuthentication and privilege requirements are minimal; an unauthenticated user can interact with the API to configure the malicious parameters.\nThe exploitation flow proceeds step-by-step as follows: First, the unauthenticated attacker crafts a malicious regular expression designed to induce excessive computational overhead, commonly associated with catastrophic backtracking patterns, along with specifically tailored matching event data. Second, the attacker interacts with the Kafka Connect REST API to configure the connector using the crafted timestamp extraction regular expression. Third, as the connector processes incoming event data matching the payload, the timestamp extraction module evaluates the regular expression against the input data. Fourth, because the evaluation lacks a defined time limit or complexity bound, the regex engine consumes excessive CPU resources on the worker thread indefinitely. Finally, the affected Kafka Connect worker thread becomes blocked, preventing further processing and stopping event delivery for the targeted connector, culminating in a Denial of Service condition."
}