CVE-2026-31984 DoS through oversized audit log entries in Guardian/CMC before 26.2.0
Unauthenticated attackers can cause denial of service by submitting oversized inputs to exhaust disk space in Nozomi Networks Guardian/CMC audit logs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-31984?
CVE-2026-31984 is a high-severity denial of service vulnerability in Nozomi Networks CMC, published on 9 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a missing size limit on input recorded into audit entries. An unauthenticated attacker can submit requests containing excessively large input that is recorded into audit entries, possibly exhausting the available disk space and rendering the system inoperable.
Weakness: CWE-770
Which versions are affected by CVE-2026-31984?
It affects 2 products.
Products include Nozominetworks Cmc, Nozominetworks Guardian.
How do I fix CVE-2026-31984?
No fix has been published for CVE-2026-31984 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-31984 being exploited?
There is no known exploitation of CVE-2026-31984 in the wild and no public exploit code.
Other vulnerabilities in Nozomi Networks CMC
- CVE-2023-29245 SQL Injection on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0
- CVE-2023-2567 Authenticated SQL Injection on Query functionality in Guardian/CMC before 22.6.3 and 23.1.0
- CVE-2023-22378 Authenticated Blind SQL Injection on sorting in Guardian/CMC before 22.6.2
- CVE-2023-23574 Authenticated Blind SQL Injection on alerts count in Guardian/CMC before 22.6.2
- CVE-2022-4259 Authenticated SQL Injection on Alerts in Guardian/CMC before 22.5.2
Sources
Also known as GHSA-4jrp-wrhh-5622.