DeutschShown in its original language — a full translation is planned for a future version.
Splunk Splunk Enterprise: Mehrere Schwachstellen
view advisory published 2026-05-20
Ein Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.
01
describes (11)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-20240US | — | — | ||
In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13,… | ||||
| CVE-2026-20239US | medium6.5 | — | ||
In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a role that h… | ||||
| CVE-2026-27141US | — | — | ||
Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic | ||||
| CVE-2025-68121US | critical10.0 | — | ||
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed h… | ||||
| CVE-2025-58190US | medium5.3 | — | ||
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides spec… | ||||
| CVE-2025-47911US | medium5.3 | — | ||
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides… | ||||
| CVE-2025-61732US | — | — | ||
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary. | ||||
| CVE-2025-61731US | — | — | ||
Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go… | ||||
| CVE-2025-61726US | — | — | ||
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum reques… | ||||
| CVE-2025-68156US | — | — | ||
Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including `flatten`, `min`, `max`, `mean`, and `median`… | ||||
| CVE-2025-22872US | — | — | ||
The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in su… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:26519 vom 2026-06-17external
- Red Hat Security Advisory RHSA-2026:26538 vom 2026-06-17external
- Red Hat Security Advisory RHSA-2026:34342 vom 2026-07-01external
- Red Hat Security Advisory RHSA-2026:43692 vom 2026-07-22external
- Splunk Security Advisory SVD-2026-0503 vom 2026-05-20external
- Splunk Security Advisory SVD-2026-0504 vom 2026-05-20external
- Splunk Security Advisory SVD-2026-0505 vom 2026-05-20external
- Splunk Security Advisory SVD-2026-0705 vom 2026-07-15external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan