Enterprise Security and SOAR
CVE-2024-22164: Denial of Service of an Investigation in Splunk Enterprise Security through Investigation attachments
In Splunk Enterprise Security (ES) versions below 7.1.2, an attacker can use investigation attachments to perform a denial of service (DoS) to the Investigation.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Splunk Enterprise Security (ES) 7.3 | 7.3.0 or later |
| Splunk Enterprise Security (ES) 7.2 | 7.2.0 or later |
| Splunk Enterprise Security (ES) 7.1 | 7.1.2 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
In Splunk Enterprise Security (ES) versions below 7.1.2, an attacker can use investigation attachments to perform a denial of service (DoS) to the Investigation. The attachment endpoint does not properly limit the size of the request which lets an attacker cause the Investigation to become inaccessible.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.