← Vulnerability feed

Vulnerability record · CVE-2022-37439 · published 16 August 2022

CVE-2022-37439: Splunk vulnerability

Splunk · Splunk

In Splunk Enterprise and Universal Forwarder versions in the following table, indexing a specially crafted ZIP file using the file monitoring input can result in a crash of the application. Attempts to restart the application would result in a crash and would require manually removing the malformed file.

5.5 CVSS 3.1 Medium EPSS 0.20% · top 91.2% CWE-409 · CWE-409
5.5CVSS 3.1 base score
0.20%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

In Splunk Enterprise and Universal Forwarder versions in the following table, indexing a specially crafted ZIP file using the file monitoring input can result in a crash of the application. Attempts to restart the application would result in a crash and would require manually removing the malformed file.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://research.splunk.com/application/b237d393-2f57-4531-aad7-ad3c17c8b041 Vendor Advisory
https://www.splunk.com/en_us/product-security/announcements/svd-2022-0803.html Vendor Advisory
https://research.splunk.com/application/b237d393-2f57-4531-aad7-ad3c17c8b041 Vendor Advisory
https://www.splunk.com/en_us/product-security/announcements/svd-2022-0803.html Vendor Advisory

Track CVE-2022-37439 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-20253Splunk Enterprise PostgreSQL sidecar missing authentication allows file writesSplunk Enterprise 10.2 below 10.2.4 and 10.x below 10.0.7 expose a PostgreSQL sidecar service endpoint that lacks authentication controls. Any networ…KEVEPSS 97%analysed7.5CVE-2014-0160OpenSSL TLS/DTLS Heartbeat Extension Out-of-Bounds Read (Heartbleed)OpenSSL 1.0.1 before 1.0.1g mishandles Heartbeat Extension packets in its TLS and DTLS implementations, causing an out-of-bounds read of process memo…KEVEPSS 100%analysed10.0CVE-2022-32158Splunk improper access control vulnerabilitySplunk Enterprise deployment servers in versions before 8.1.10.1, 8.2.6.1, and 9.0 let clients deploy forwarder bundles to other deployment clients t…EPSS 1.4%9.8CVE-2022-32221Haxx curl information exposure vulnerabilityWhen doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOP…EPSS 4.4%9.8CVE-2022-36227Libarchive null pointer dereference vulnerabilityIn libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the functio…EPSS 2.4%9.8CVE-2022-37437Splunk improper certificate validation vulnerabilityWhen using Ingest Actions to configure a destination that resides on Amazon Simple Storage Service (S3) in Splunk Web, TLS certificate validation is …EPSS 0.44%9.8CVE-2022-32207Haxx curl incorrect default permissions vulnerabilityWhen curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from …EPSS 7.7%9.8CVE-2021-3520Lz4 project lz4 integer overflow vulnerabilityThere's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading t…EPSS 3.2%

Source: NIST National Vulnerability Database (record CVE-2022-37439), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.