CVE-2026-76401: Splunk Connect for Kafka DoS Vulnerability

CVE-2026-76401 Overview

CVE-2026-76401 affects Splunk Connect for Kafka versions below 2.2.7. An unauthenticated attacker who can reach the Kafka Connect Representational State Transfer (REST) API can configure timestamp extraction with a crafted regular expression and matching event data. This configuration blocks a Kafka Connect worker thread and stops event delivery for the affected connector. The vulnerability exists because timestamp extraction evaluates customer-supplied regular expressions without a time limit, enabling an algorithmic complexity attack classified under [CWE-407].

Critical Impact
Unauthenticated network attackers can halt event delivery on a Kafka Connect worker thread by supplying a malicious regular expression, causing a denial-of-service condition on the affected connector.

Affected Products

Splunk Connect for Kafka versions below 2.2.7

Discovery Timeline

2026-08-19 - CVE-2026-76401 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76401

Vulnerability Analysis

The flaw resides in the timestamp extraction logic of Splunk Connect for Kafka. The connector accepts a user-configurable regular expression used to parse timestamps from incoming event data. The regex engine evaluates these patterns without an execution timeout, so a pathological pattern combined with matching input can drive the engine into catastrophic backtracking. Because the evaluation runs on a Kafka Connect worker thread, sustained backtracking blocks the thread and stalls event delivery for the affected connector. The Kafka Connect REST API accepts the malicious configuration without authentication when it is reachable on the network, which is what elevates a configuration option to an exploitable vulnerability.

Root Cause

The root cause is uncontrolled resource consumption during regular expression matching, an instance of Regular Expression Denial of Service (ReDoS). The timestamp extraction routine does not apply an execution deadline or complexity guard when compiling or evaluating operator-supplied patterns against event payloads.

Attack Vector

Exploitation requires network access to the Kafka Connect REST API. An unauthenticated attacker submits a connector configuration that sets timestamp extraction to a crafted regular expression. The attacker then produces or waits for event data that triggers exponential backtracking. The worker thread executing the match stops making progress, and events queued for the connector are no longer delivered to Splunk. Refer to the Splunk Security Advisory SVD-2026-0808 for vendor-provided technical details.

Detection Methods for CVE-2026-76401

Indicators of Compromise

Kafka Connect worker threads consuming sustained CPU on a single core with no forward progress in offsets or throughput metrics.
Connector configuration changes submitted through the Kafka Connect REST API from unexpected source addresses or without change-management authorization.
Timestamp extraction configuration entries containing unusually complex regular expressions with nested quantifiers or alternation.

Detection Strategies

Audit Kafka Connect REST API access logs for PUT and POST requests to /connectors and /connectors/{name}/config endpoints originating from untrusted networks.
Alert on connector lag growth combined with flat or zero throughput on Splunk Connect for Kafka instances.
Inspect connector configurations for regular expression patterns known to exhibit exponential backtracking, such as nested quantifiers of the form (a+)+ or overlapping alternations.

Monitoring Recommendations

Monitor JVM thread state on Kafka Connect workers for threads stuck in RUNNABLE state within regex evaluation frames.
Track connector task status transitions to FAILED or stalled states through the Kafka Connect REST API /connectors/{name}/status endpoint.
Correlate consumer group lag metrics with connector configuration change events to identify configuration-induced stalls.

How to Mitigate CVE-2026-76401

Immediate Actions Required

Upgrade Splunk Connect for Kafka to version 2.2.7 or later, which contains the vendor fix.
Restrict network access to the Kafka Connect REST API so only trusted management hosts and administrators can reach it.
Review existing connector configurations for suspicious timestamp extraction regular expressions and remove or replace them.

Patch Information

Splunk addressed this vulnerability in Splunk Connect for Kafka 2.2.7. See the Splunk Security Advisory SVD-2026-0808 for full patch details and the Install Splunk Connect for Kafka documentation for upgrade guidance.

Workarounds

Place the Kafka Connect REST API behind a firewall or reverse proxy that enforces authentication and IP allow-listing until the patch is deployed.
Disable or avoid timestamp extraction configurations that rely on operator-supplied regular expressions on affected connectors.
Apply network segmentation to ensure the Kafka Connect REST API is not exposed on untrusted or internet-facing interfaces.

bash

# Example: restrict Kafka Connect REST API to loopback via listener binding
# In connect-distributed.properties on affected worker nodes
listeners=HTTP://127.0.0.1:8083
rest.advertised.host.name=127.0.0.1
rest.advertised.port=8083