CVE-2026-47905: Uncontrolled Resource Consumption (CWE-400) in Adobe Content Credentials Rust SDK
Affects Adobe Content Credentials Rust SDKSource CVE Database V5
Not known to be exploited · CVSS 6.2 Medium : update Adobe Content Credentials Rust SDK when convenient.
Data as of 10/24/2026, 17:08:26 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 16% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| AdobeContent Credentials Rust SDK | Affected
| Fixed in– |
| AdobeContent Credentials JS SDK | Affected
| Fixed in– |
npmc2pa-webpkg:npm/c2pa-webOther threats | Affected
| Fixed in– |
npmc2papkg:npm/c2paOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Until an official fix is released, consider implementing resource usage monitoring and limiting mechanisms to mitigate potential denial-of-service conditions.
Description
CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consumption vulnerability. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
Impact
Successful exploitation results in denial-of-service by exhausting system resources, causing application unavailability. There is no impact on confidentiality or integrity. The vulnerability can be triggered remotely with low complexity and no privileges or user interaction needed.