CVE-2025-20370 json
Denial of Service (DoS) through Multiple LDAP Bind Requests in Splunk Enterprise
published 2025-10-01 13 mo ago modified 2026-10-18 21 d ago also EUVD-2025-32717
- cvss
- 4.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 46%
- public exploits
- 0
- none known
Summary
In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a user who holds a role that contains the high-privilege capability `change_authentication`, could send multiple LDAP bind requests to a specific internal endpoint, resulting in high server CPU usage, which could potentially lead to a denial of service (DoS) until the Splunk Enterprise instance is restarted. See https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.0/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities and https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.0/use-ldap-as-an-authentication-scheme/configure-ldap-with-splunk-web#cfe47e31_007f_460d_8b3d_8505ffc3f0dd__Configure_LDAP_with_Splunk_Web for more information.
Patch / fix
- Splunk Splunk Enterprise 9.2.8, 9.3.6, 9.4.4, 10.0.1
- Splunk Splunk Enterprise Cloud 9.2.2406.123, 9.3.2408.118, 9.3.2411.108
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 13 mo ago
Exploit prediction
0.56% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
Affected products
- Splunk Splunk Enterprise
- Splunk Splunk Enterprise Cloud
Classification
References
-
advisory.splunk.com
/advisories/SVD-2025-1005
vendor-advisory
Sources
- CVE List CVE-2025-20370
- NVD CVE-2025-20370
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.