CVE-2024-22164 Denial of Service of an Investigation in Splunk Enterprise Security through Investigation attachments
An attacker can cause a denial of service in Splunk Enterprise Security investigations by sending oversized attachment requests, rendering them inaccessible.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-22164?
CVE-2024-22164 is a medium-severity denial of service vulnerability in Splunk Enterprise Security (ES), published on 9 Jan 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In Splunk Enterprise Security (ES) versions below 7.1.2, an attacker can use investigation attachments to perform a denial of service (DoS) to the Investigation. The attachment endpoint does not properly limit the size of the request which lets an attacker cause the Investigation to become inaccessible.
Which versions are affected by CVE-2024-22164?
It affects 1 product.
Products include Splunk Enterprise Security.
How do I fix CVE-2024-22164?
No fix has been published for CVE-2024-22164 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-22164 being exploited?
There is no known exploitation of CVE-2024-22164 in the wild and no public exploit code.
Other vulnerabilities in Splunk Enterprise Security (ES)
- CVE-2026-76387 SPL Injection through the REST API in Splunk Enterprise Security
- CVE-2026-76388 Privilege Escalation through Search Macro Permissions in Splunk Enterprise Security
- CVE-2024-22165 Denial of Service in Splunk Enterprise Security of the Investigations manager through Investigation creation
Sources
Also known as GHSA-5q6v-3768-8xq7.