CVE-2021-3422

CVE-2021-3422 is a denial-of-service vulnerability in Splunk Enterprise versions before 7.3.9, 8.0.9, and 8.1.3, specifically impacting instances configured to index Universal Forwarder traffic. The flaw stems from insufficient validation of a key-value field within the Splunk-to-Splunk protocol. With a CVSS score of 7.5 (HIGH), this vulnerability can be exploited remotely without authentication, leading to a denial of service. While no public exploits or active exploitation have been observed, securing Splunk forwarding with TLS or a token significantly reduces the severity by requiring compromise of those security measures.