CVE-2021-3422
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2021
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Indexer denial-of-service via malformed S2S request
The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index Universal Forwarder traffic. The vulnerability impacts Splunk Enterprise versions before 7.3.9, 8.0 versions before 8.0.9, and 8.1 versions before 8.1.3. It does not impact Universal Forwarders. When Splunk forwarding is secured using TLS or a Token, the attack requires compromising the certificate or token, or both. Implementation of either or both reduces the severity to Medium.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Splunk Enterprise
- Vendor
- Splunk
- Product
- Splunk Enterprise
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 8.2 version(s) before 8.2.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 8.1 version(s) before 8.1.3 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 8.0 version(s) before 8.0.9 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 7.3 version(s) before 7.3.9 | affected | Unavailable | Unavailable | Unavailable | None listed |