{"id":"CVE-2026-97334","state":"PUBLISHED","title":"Network messaging layer decompression resource exhaustion","description":"The network messaging layer contained improper handling of highly compressed data affecting service availability.  Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale.","publishedAt":"2026-10-13T14:27:01.613Z","updatedAt":"2026-10-13T14:40:43.295Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"Commvault"},"assigner":"Commvault","products":["Commvault Commvault Cloud"],"affected":[{"vendor":"Commvault","product":"Commvault Cloud","defaultStatus":"unknown","versions":[{"version":"11.46.0","status":"affected","lessThanOrEqual":"11.46.29","changes":[{"at":"11.46.30","status":"unaffected"}],"versionType":"custom"},{"version":"11.44.0","status":"affected","lessThanOrEqual":"11.44.24","changes":[{"at":"11.44.25","status":"unaffected"}],"versionType":"custom"},{"version":"11.40.0","status":"affected","lessThanOrEqual":"11.40.77","changes":[{"at":"11.40.78","status":"unaffected"}],"versionType":"custom"},{"version":"11.36.0","status":"affected","lessThanOrEqual":"11.36.126","changes":[{"at":"11.36.127","status":"unaffected"}],"versionType":"custom"}],"platforms":["Windows","Linux"]}],"references":["https://documentation.commvault.com/securityadvisories/CV_2026_10_3.html"],"weaknesses":["CWE-409"],"ingestedAt":"2026-10-29T20:13:43.249Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/97xxx/CVE-2026-97334.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-97334","state":"PUBLISHED","datePublished":"2026-10-13T14:27:01.613Z","dateUpdated":"2026-10-13T14:40:43.295Z","assignerShortName":"Commvault","assignerOrgId":"050066fd-a2f9-4f32-ab5d-4c53f48bc333","dateReserved":"2026-09-24T12:01:47.252Z"},"containers":{"cna":{"title":"Network messaging layer decompression resource exhaustion","descriptions":[{"lang":"en","value":"The network messaging layer contained improper handling of highly compressed data affecting service availability.  Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale."}],"affected":[{"vendor":"Commvault","product":"Commvault Cloud","defaultStatus":"unknown","versions":[{"version":"11.46.0","status":"affected","lessThanOrEqual":"11.46.29","changes":[{"at":"11.46.30","status":"unaffected"}],"versionType":"custom"},{"version":"11.44.0","status":"affected","lessThanOrEqual":"11.44.24","changes":[{"at":"11.44.25","status":"unaffected"}],"versionType":"custom"},{"version":"11.40.0","status":"affected","lessThanOrEqual":"11.40.77","changes":[{"at":"11.40.78","status":"unaffected"}],"versionType":"custom"},{"version":"11.36.0","status":"affected","lessThanOrEqual":"11.36.126","changes":[{"at":"11.36.127","status":"unaffected"}],"versionType":"custom"}],"platforms":["Windows","Linux"]}],"references":[{"url":"https://documentation.commvault.com/securityadvisories/CV_2026_10_3.html"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"version":"4.0","baseScore":8.7,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)"}]}],"providerMetadata":{"shortName":"Commvault","orgId":"050066fd-a2f9-4f32-ab5d-4c53f48bc333","dateUpdated":"2026-10-13T14:27:01.613Z"},"credits":[{"lang":"en","value":"Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase.","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-13T14:40:07.536505Z","id":"CVE-2026-97334","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-409","type":"CWE","lang":"en","description":"CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-13T14:40:43.295Z"}}]}}}