CVE-2026-47902

CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consumption vulnerability. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

CVSS v3 6.2 MEDIUM

6.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-61.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:adobe:c2pa::::::rust::*
	cpe:2.3:a:adobe:c2pa-web::::::node.js::*

History

23 Jul 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) Las versiones c2pa-web@0.7.1, c2pa-v0.80.1 y anteriores de CAI Content Credentials se ven afectadas por una vulnerabilidad de Consumo de Recursos No Controlado. Un atacante podría explotar esta vulnerabilidad para agotar los recursos del sistema, lo que resultaría en una condición de denegación de servicio de la aplicación. La explotación de este problema no requiere interacción del usuario.

15 Jun 2026, 17:42

Type	Values Removed	Values Added
References	~~() https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-61.html -~~	() https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-61.html - Vendor Advisory
CPE		cpe:2.3:a:adobe:c2pa::::::rust::* cpe:2.3:a:adobe:c2pa-web::::::node.js::*
First Time		Adobe c2pa Adobe c2pa-web Adobe

09 Jun 2026, 22:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-09 22:16

Updated : 2026-07-23 09:10

NVD link : CVE-2026-47902

Mitre link : CVE-2026-47902

CVE.ORG link : CVE-2026-47902

JSON object : View

Products Affected

adobe

c2pa-web
c2pa

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2026-47902", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47902", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T15:56:56.297457Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@adobe.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.5}]}, "affected": [{"source": "psirt@adobe.com", "affectedData": [{"vendor": "Adobe", "product": "CAI Content Credentials", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "c2pa-v0.80.1"}], "defaultStatus": "affected"}]}], "published": "2026-06-09T22:16:25.177", "references": [{"url": "https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-61.html", "tags": ["Vendor Advisory"], "source": "psirt@adobe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@adobe.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consumption vulnerability. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction."}, {"lang": "es", "value": "Las versiones c2pa-web@0.7.1, c2pa-v0.80.1 y anteriores de CAI Content Credentials se ven afectadas por una vulnerabilidad de Consumo de Recursos No Controlado. Un atacante podr\u00eda explotar esta vulnerabilidad para agotar los recursos del sistema, lo que resultar\u00eda en una condici\u00f3n de denegaci\u00f3n de servicio de la aplicaci\u00f3n. La explotaci\u00f3n de este problema no requiere interacci\u00f3n del usuario."}], "lastModified": "2026-07-23T09:10:00.113", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:c2pa:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "FAC5EB4E-D740-4724-82DA-7C49F0138397", "versionEndIncluding": "0.80.1"}, {"criteria": "cpe:2.3:a:adobe:c2pa-web:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "4402A37D-5CCD-46EB-8942-3BA694C3F770", "versionEndIncluding": "0.7.1"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@adobe.com"}