CVE-2026-31984: DoS through oversized audit log entries in Guardian/CMC before 26.2.0
A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a missing size limit on input recorded into audit entries. An unauthenticated attacker can submit requests containing excessively large input that is recorded into audit entries, possibly exhausting the available disk space and rendering the system inoperable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.2.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31984?
CVE-2026-31984 has a severity rating of 8.7, classified as high.
How do I fix CVE-2026-31984?
To fix CVE-2026-31984, update your Guardian CMC software to version 26.2.0 or higher.
What type of attack does CVE-2026-31984 enable?
CVE-2026-31984 enables a denial-of-service attack through oversized audit log entries.
Who is affected by CVE-2026-31984?
Any user of Guardian CMC versions prior to 26.2.0 is affected by CVE-2026-31984.
What is the impact of CVE-2026-31984?
The impact of CVE-2026-31984 is that it can lead to a denial-of-service condition, disrupting system availability.