{"api_version":"1","generated_at":"2026-10-14T06:54:37+00:00","cve":"CVE-2026-97334","urls":{"html":"https://cve.report/CVE-2026-97334","api":"https://cve.report/api/cve/CVE-2026-97334.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-97334","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-97334"},"summary":{"title":"Network messaging layer decompression resource exhaustion","description":"The network messaging layer contained improper handling of highly compressed data affecting service availability.  Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale.","state":"PUBLISHED","assigner":"Commvault","published_at":"2026-10-13 15:17:52","updated_at":"2026-10-13 15:17:52"},"problem_types":["CWE-409","CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)","CWE-409 CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)"],"metrics":[{"version":"4.0","source":"050066fd-a2f9-4f32-ab5d-4c53f48bc333","type":"Secondary","score":"8.7","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"CVSS","score":"8.7","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","data":{"baseScore":8.7,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"}}],"references":[{"url":"https://documentation.commvault.com/securityadvisories/CV_2026_10_3.html","name":"https://documentation.commvault.com/securityadvisories/CV_2026_10_3.html","refsource":"050066fd-a2f9-4f32-ab5d-4c53f48bc333","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97334","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97334","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Commvault","product":"Commvault Cloud","version":"affected 11.46.0 11.46.29 custom","platforms":["Windows","Linux"]},{"source":"CNA","vendor":"Commvault","product":"Commvault Cloud","version":"affected 11.44.0 11.44.24 custom","platforms":["Windows","Linux"]},{"source":"CNA","vendor":"Commvault","product":"Commvault Cloud","version":"affected 11.40.0 11.40.77 custom","platforms":["Windows","Linux"]},{"source":"CNA","vendor":"Commvault","product":"Commvault Cloud","version":"affected 11.36.0 11.36.126 custom","platforms":["Windows","Linux"]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase.","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-97334","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-13T14:40:07.536505Z","version":"2.0.3"},"type":"ssvc"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-409","description":"CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-13T14:40:43.295Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unknown","platforms":["Windows","Linux"],"product":"Commvault Cloud","vendor":"Commvault","versions":[{"changes":[{"at":"11.46.30","status":"unaffected"}],"lessThanOrEqual":"11.46.29","status":"affected","version":"11.46.0","versionType":"custom"},{"changes":[{"at":"11.44.25","status":"unaffected"}],"lessThanOrEqual":"11.44.24","status":"affected","version":"11.44.0","versionType":"custom"},{"changes":[{"at":"11.40.78","status":"unaffected"}],"lessThanOrEqual":"11.40.77","status":"affected","version":"11.40.0","versionType":"custom"},{"changes":[{"at":"11.36.127","status":"unaffected"}],"lessThanOrEqual":"11.36.126","status":"affected","version":"11.36.0","versionType":"custom"}]}],"credits":[{"lang":"en","type":"reporter","value":"Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."}],"descriptions":[{"lang":"en","value":"The network messaging layer contained improper handling of highly compressed data affecting service availability.  Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale."}],"metrics":[{"cvssV4_0":{"baseScore":8.7,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"description":"CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)","lang":"en"}]}],"providerMetadata":{"dateUpdated":"2026-10-13T14:27:01.613Z","orgId":"050066fd-a2f9-4f32-ab5d-4c53f48bc333","shortName":"Commvault"},"references":[{"url":"https://documentation.commvault.com/securityadvisories/CV_2026_10_3.html"}],"title":"Network messaging layer decompression resource exhaustion"}},"cveMetadata":{"assignerOrgId":"050066fd-a2f9-4f32-ab5d-4c53f48bc333","assignerShortName":"Commvault","cveId":"CVE-2026-97334","datePublished":"2026-10-13T14:27:01.613Z","dateReserved":"2026-09-24T12:01:47.252Z","dateUpdated":"2026-10-13T14:40:43.295Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-13 15:17:52","lastModifiedDate":"2026-10-13 15:17:52","problem_types":["CWE-409","CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)","CWE-409 CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)"],"metrics":{"cvssMetricV40":[{"source":"050066fd-a2f9-4f32-ab5d-4c53f48bc333","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-13T14:40:07.536505Z","id":"CVE-2026-97334","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"97334","Ordinal":"1","Title":"Network messaging layer decompression resource exhaustion","CVE":"CVE-2026-97334","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"97334","Ordinal":"1","NoteData":"The network messaging layer contained improper handling of highly compressed data affecting service availability.  Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale.","Type":"Description","Title":"Network messaging layer decompression resource exhaustion"}]}}}