Denial of Service (DoS) in Splunk Enterprise Using a Malformed SAML Request

Advisory ID: SVD-2023-0802

CVE ID: CVE-2023-40593

Published: 2023-08-30

Last Update: 2023-08-30

CVSSv3.1 Score: 6.3, Medium

CWE: CWE-400

Bug ID: SPL-219455


In Splunk Enterprise versions lower than 9.0.6, and 8.2.12, an attacker can send a malformed security assertion markup language (SAML) request to the /saml/acs REST endpoint which can cause a denial of service through a crash or hang of the Splunk daemon.

The SAML extensible markup language (XML) parser does not fail SAML signature validation when the attacker modifies the URI in the SAML request. Instead it attempts to access the modified URI, which causes the Splunk daemon to crash or hang.


Upgrade Splunk Enterprise to versions 8.2.12 and 9.0.6. This vulnerability does not affect Splunk Enterprise versions 9.1.0 and higher.

Splunk is actively monitoring and patching Splunk Cloud Platform instances.

Product Status

ProductVersionComponentAffected VersionFix Version
Splunk Enterprise8.2Splunk Web8.2.0 to
Splunk Enterprise9.0Splunk Web9.0.0 to
Splunk Cloud-Splunk Web9.0.2305.100 and below9.0.2305.200

Mitigations and Workarounds

No mitigations




Splunk rates this vulnerability as 6.3, Medium, with a CVSSv3.1 vector of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H.


Aaron Devaney (Dodekeract)