What’s Vulnerable › Vulnerabilities

CVE-2021-3422: Indexer denial-of-service via malformed S2S request

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-25 · updated 2026-06-17
• Weakness: CWE-125

Description

The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index Universal Forwarder traffic. The vulnerability impacts Splunk Enterprise versions before 7.3.9, 8.0 versions before 8.0.9, and 8.1 versions before 8.1.3. It does not impact Universal Forwarders. When Splunk forwarding is secured using TLS or a Token, the attack requires compromising the certificate or token, or both. Implementation of either or both reduces the severity to Medium.

Affected products

• Splunk Enterprise: before 7.3.9; from 8.0 before 8.0.9; from 8.1 before 8.1.3 — fixed in 7.3.9, 8.0.9, 8.1.3

How to fix

Upgrade to a fixed version: Splunk Enterprise 7.3.9, 8.0.9, 8.1.3. Check the vendor advisory for mitigations.

References

• https://claroty.com/2022/03/24/blog-research-locking-down-splunk-enterprise-indexers-and-forwarders/
• https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html
• https://claroty.com/2022/03/24/blog-research-locking-down-splunk-enterprise-indexers-and-forwarders/
• https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html

Get alerted when CVE-2021-3422 or the next vulnerability affects your stack