Third-Party Package Updates in Splunk Enterprise - October 2026
Advisory ID: SVD-2026-1009
CVE ID:
Published: 2026-10-21
Last Update: 2026-10-21
Description
Splunk remedied common vulnerabilities and exposures (CVEs) in third-party packages in Splunk Enterprise versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16 or higher.
| Package | Remediation | CVE | Severity |
|---|---|---|---|
| github.com/golang/go1 | Upgraded golang to Go compiler in `postgres service / postgres` to version go1.26.3 | Multiple | Critical |
| google.golang.org/grpc2 | Upgraded golang-grpc in `postgres service / postgres` to version 1.81.0 | CVE-2026-33186 | Critical |
| golang.org/x/crypto3 | Upgraded golang.org/x/crypto in `mongorestore and mongodump` to version 0.52.0 | Multiple | Critical |
| golang.org/x/net4 | Upgraded golang.org/x/net in `mongorestore and mongodump` to version 0.55.0 | Multiple | Critical |
| brace-expansion5 | Upgraded brace-expansion to version 5.0.9 | Multiple | High |
| protobufjs6 | Upgraded protobufjs to version 7.6.5 | CVE-2026-59877 | Medium |
| DOMpurify7 | Upgraded DOMpurify to version 3.4.14 | Multiple | Low |
| bytes8 | Upgraded bytes to version 1.11.1 | CVE-2026-25541 | High |
1 Upgraded golang in postgres service / postgres to version go1.26.3 to remedy CVE-2025-61726, CVE-2025-61731, CVE-2025-61732, CVE-2025-68119, CVE-2025-68121, CVE-2026-25679, CVE-2026-27137, CVE-2026-27140, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281, CVE-2026-32283 at opt/splunk/packages/postgres-1.0.0-d6cca743-20260310t231133.tar.gz/splunk-postgres.
Splunk Enterprise versions 9.4.x do not have postgres service.
2 Upgraded golang-grpc in postgres service / postgres to version 1.81.0 to remedy CVE-2026-33186 at opt/splunk/packages/postgres-1.0.0-d6cca743-20260310t231133.tar.gz/splunk-postgres.
Splunk Enterprise versions 9.4.x do not have postgres service.
3 Upgraded golang crypto in mongorestore and mongodump to version 0.52.0 to remedy CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-42508, CVE-2026-46595 at splunk/bin/mongorestore and splunk/bin/mongorestore.
4 Upgraded golang net in mongorestore and mongodump to version 0.55.0 to remedy CVE-2026-27141, CVE-2026-39821 at splunk/bin/mongorestore and splunk/bin/mongorestore.
5 Upgraded brace-expansion to version 5.0.9 to remedy CVE-2026-13149, CVE-2026-14257, and CVE-2026-69152 at /opt/splunk/etc/appserver/devplat/dashboard-enterprise/package.json
6 Upgraded protobufjs to version 7.6.5 to remedy CVE-2026-59877 at /opt/splunk/etc/appserver/devplat/dashboard-enterprise/package.json and /opt/splunk/etc/appserver/devplat/dashboard-enterprise/yarn.lock.
7 Upgraded DOMpurify to version 3.4.14 to remedy CVE-2026-75838, CVE-2026-66010, and CVE-2026-65898 at $SPLUNK_HOME/etc/apps/splunk-dashboard-studio/appserver/static/build/chunks/purify.es-NRWSUWWB.js.
8 Upgraded bytes to version 1.11.1 to remedy CVE-2026-25541 at /opt/splunk/bin/mongod_upgrade.
Solution
Upgrade Splunk Enterprise to versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16 or higher.
Product Status
| Product | Base Version | Affected Version | Fix Version |
|---|---|---|---|
| Splunk Enterprise | 10.4 | 10.4.0 to 10.4.3 | 10.4.4 |
| Splunk Enterprise | 10.2 | 10.2.0 to 10.2.7 | 10.2.8 |
| Splunk Enterprise | 10.0 | 10.0.0 to 10.0.10 | 10.0.11 |
| Splunk Enterprise | 9.4 | 9.4.0 to 9.4.15 | 9.4.16 |
Severity
Unless otherwise stated, Splunk adopts the vendor’s severity rating first, if available, or the National Vulnerability Database (NVD)’s rating, otherwise.