Commvault Cloud network decompression resource exhaustion can disrupt service availability

The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale.

Commvault Cloud on Windows and Linux is affected in the following branches:

• 11.46: 11.46.0 through 11.46.29 are affected. 11.46.30 and higher are listed as resolved by the Commvault advisory.
• 11.44: 11.44.0 through 11.44.24 are affected. 11.44.25 and higher are listed as resolved.
• 11.40: 11.40.0 through 11.40.77 are affected. 11.40.78 and higher are listed as resolved.
• 11.36: 11.36.0 through 11.36.126 are affected. 11.36.127 and higher are listed as resolved.

The operational scope includes CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale. Commvault's advisory states that supported versions not listed are unaffected and that unsupported versions must be upgraded. The normalized record nevertheless retains default_status as unknown outside the listed ranges, so unverified or unsupported branches should not be assumed safe.

Commvault identifies the affected component as the network messaging layer, which improperly handles highly compressed data. The weakness is classified as CWE-409, where compressed input can expand substantially during processing and consume excessive service resources. The attacker-controlled input is inferred from the network reachability of the issue, but the record does not identify the endpoint, protocol, or compression format. The documented attack conditions are network access, no privileges, and no user interaction. The stated outcome is resource exhaustion and reduced service availability; the specific parser, decompression limits, CPU or memory thresholds, and log signature remain undisclosed. The deployment scope to review includes CommServe, Web Server, Command Center, MediaAgents, clients, and HyperScale on Windows and Linux.

• Reachability: The issue is described as remotely reachable over the network.
• Authentication and interaction: The record indicates that no privileges and no user interaction are required.
• Complexity: The recorded attack complexity is low.
• Status: The normalized record sets public_exploit to false and known_exploited to null. CISA enrichment returned with the record marks exploitation as none at the time of its assessment. No specific exploit, campaign, victim, or IOC is identified in the available evidence.

The flaw can cause resource exhaustion in the network messaging layer, reducing or interrupting Commvault service availability. Because the record describes network access without requiring privileges or user interaction, a reachable messaging service could potentially be used to cause remote disruption. The recorded impact is limited to availability; no confidentiality or integrity impact is stated. Possible organizational consequences include interruption of backup, administration, or recovery operations that depend on the affected component. The record does not describe code execution, data disclosure, persistence, or spread to other systems.

• Abnormal compressed-data processing can exhaust CPU, memory, or other service resources, causing Commvault service degradation or interruption.
• The disruption may affect operations that depend on CommServe, Web Server, Command Center, MediaAgents, clients, or HyperScale, depending on which component receives and processes the network data.
• Because the record describes network reachability without requiring privileges, deployments with reachable messaging services should receive priority in update planning.
• The record does not identify an impact to confidentiality or integrity. The available evidence does not establish data disclosure, code execution, or system takeover.

1. Upgrade all Commvault installations to a resolved maintenance release, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale.
2. Use the confirmed release for the matching branch:

• Branch 11.46: upgrade to 11.46.30 and higher releases as listed by the advisory.
• Branch 11.44: upgrade to 11.44.25 and higher releases as listed by the advisory.
• Branch 11.40: upgrade to 11.40.78 and higher releases as listed by the advisory.
• Branch 11.36: upgrade to 11.36.127 and higher releases as listed by the advisory.

1. If an unsupported release is in use, upgrade to a supported release before assessing remediation status. Do not treat a fix in one branch as evidence that a parallel branch is covered.
2. After updating, open Command Center and navigate to Manage > Servers or Manage > Infrastructure > Servers. Filter for the relevant roles and confirm that every server shows a resolved maintenance release or higher within its branch.
3. If the version of any component cannot be verified, treat that component as not confirmed remediated and complete the inventory before closing the issue.

1. Inventory every Commvault deployment on Windows and Linux, not only central management servers.
2. In Command Center, open Manage > Servers or Manage > Infrastructure > Servers.
3. Filter for the relevant roles, including Web Server, CommServe, MediaAgents, clients, and HyperScale, then review the installed maintenance release.
4. Compare each installation with the affected and resolved branches in the version scope, and confirm that all components in the same deployment have been updated.
5. No vendor-specific IOC or log signature is provided. Routine monitoring for service errors or unusual CPU and memory consumption is only a precaution, not a confirmed indicator; absence of an alert does not prove that a system is safe.