CVE-2022-43572: splunk Uncontrolled Resource Consumption
CVSS: 7.5v3.1HighModified
Published 04-11-2022Last modified 01-05-2025
Vulnerability summary
CVE-2022-43572 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in splunk. EPSS estimates a 0.85% chance of exploitation in the next 30 days, higher than 57.4% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
0.85%
0%100%
Low · +0.03 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 04-11-2022PublishedVulnerability first disclosed.
- 01-05-2025Last modifiedVulnerability information updated.
Description
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, sending a malformed file through the Splunk-to-Splunk (S2S) or HTTP Event Collector (HEC) protocols to an indexer results in a blockage or denial-of-service preventing further indexing.
CVSS metrics
2 scores · 2 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSources2 sources · 6.5–7.5
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
0.85%
Chance of exploitation in the next 30 days
Percentile
57%
Versus all other CVEs
30-day change
+0.03 pp
From 0.82% on 19-09-2026
19-09-202619-10-2026
EPSS score0.85%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Affected systems
Splunk3 products
- splunk≥ 8.1.0, < 8.1.12 | ≥ 8.2.0, < 8.2.9 | ≥ 9.0.0, < 9.0.2
- splunk_cloud_platform< 9.0.2209
- splunk enterprise≥ 8.1, < 8.1.12 | ≥ 8.2, < 8.2.9 | ≥ 9.0, < 9.0.2
1 vendor · 3 products