CVE-2026-47902: CAI Content Credentials Resource Exhaustion Denial-of-Service

Technical summary

CVE-2026-47902 is classified as an Uncontrolled Resource Consumption vulnerability (CWE-400) affecting Adobe's Content Provenance and Authentication libraries. The flaw exists in c2pa-web versions up to and including 0.7.1 and c2pa core versions up to and including v0.80.1. The vulnerability has a CVSS v3.1 score of 6.2 (MEDIUM severity) with a vector of AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating local attack surface, low complexity, no privileges required, no user interaction, and high impact to availability. The attack does not compromise confidentiality or integrity, only availability.

Business impact

For organizations deploying c2pa-web or c2pa libraries to validate content authenticity and provenance, this vulnerability creates a denial-of-service risk. Applications that rely on these libraries to process user-supplied content credentials or metadata could become unresponsive when processing malicious inputs. This is particularly concerning for media publishers, authentication platforms, and content management systems that depend on c2pa for verifying digital signatures and tracking content origins. Availability disruptions can interrupt content verification workflows and erode trust in authentication mechanisms.

Affected systems

Adobe c2pa and c2pa-web libraries are affected. Specifically: c2pa-web version 0.7.1 and all earlier versions; c2pa version v0.80.1 and all earlier versions. Any application embedding or using these libraries—whether in Node.js environments (c2pa-web) or web contexts—is vulnerable if running unpatched versions. Organizations should inventory dependencies on these libraries across their software supply chain.

Exploitability

This vulnerability requires no user interaction and can be triggered with local access to the affected system or application. An attacker can send crafted input directly to the application using the vulnerable library; the resource exhaustion occurs automatically without requiring social engineering or user click-through. This makes the attack straightforward to execute once an attacker can reach the application's processing functions. However, the CVSS vector specifies AV:L (local attack vector), meaning the attacker must have local access to the target system, which somewhat constrains the attack surface compared to network-exploitable flaws.

Remediation

Upgrade c2pa-web to version 0.7.2 or later (verify against Adobe's official release notes). Upgrade c2pa to version v0.80.2 or later. If immediate patching is not feasible, consider implementing rate limiting or resource caps at the application or container level to mitigate resource exhaustion. Input validation and size limits on credential payloads may provide temporary defense-in-depth.

Patch guidance

Monitor Adobe's official repositories and security advisories for patch releases addressing this vulnerability. Patches should be tested in a non-production environment before deployment. For organizations using c2pa-web in Node.js or JavaScript environments, update via npm; for c2pa core integrations, follow Adobe's published patch guidance. Verify that updated library versions are actually deployed and that no cache or bundled copies of older versions are inadvertently used.

Detection guidance

Monitor for sudden spikes in memory or CPU consumption correlated with processing of content credentials or metadata. Log and alert on error conditions related to resource exhaustion (out-of-memory, timeout errors) within c2pa processing pipelines. If you have telemetry on library versions in use, flag deployments still running c2pa-web ≤0.7.1 or c2pa ≤v0.80.1. Runtime application performance monitoring (APM) tools can help detect denial-of-service patterns caused by this vulnerability.

Why prioritize this

This vulnerability merits prompt attention because it enables denial-of-service attacks without user interaction or elevated privileges, and affects core authentication and content provenance mechanisms that many modern media and publishing platforms depend on. Although CVSS is MEDIUM and local access is required, the ease of exploitation and direct impact to service availability make it a priority for patching cycles. Organizations processing untrusted content credentials should prioritize updates.

Risk score, explained

The CVSS v3.1 score of 6.2 (MEDIUM) reflects the high availability impact (A:H) but limited attack vector (local only, AV:L) and lack of confidentiality or integrity compromise. In environments where the c2pa library processes input from less-trusted sources or where local access is plausible, effective risk may be elevated; in tightly controlled backend scenarios, risk may be lower. The lack of KEV designation indicates this has not yet been observed in active exploitation campaigns, but that should not discourage rapid patching given the straightforward attack mechanism.

Frequently asked questions