CVE-2026-100138: CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)
Published Oct 13, 2026
·Updated
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
Affected Software
4 affected components
CAI Content Credentials
Adobe C2pa Rust<0.91.1
Adobe C2pa-web Node.js<0.15.3
Adobe C2patool<0.28.1
Event History
Oct 13, 2026
CVE Published
12:00 AM
Data Sourced
12:00 AM
SeverityWeaknessAffected Software
CVE Published
via MITRE·09:27 PM
Data Sourced
via MITRE·09:27 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:17 PM
DescriptionSeverityWeaknessAffected Software
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-95634
- CVE-2026-100124
- CVE-2026-100123
- CVE-2026-104345
- CVE-2026-100122
- CVE-2026-100121
- CVE-2026-100120
- CVE-2026-100119
- CVE-2026-100118
- CVE-2026-100117
- CVE-2026-100115
- CVE-2026-100114
- CVE-2026-100139
- CVE-2026-100137
- CVE-2026-106627
- CVE-2026-95632
- CVE-2026-100113
- CVE-2026-100136
- CVE-2026-100135
- CVE-2026-103296
- CVE-2026-105902
- CVE-2026-100125
- CVE-2026-100116
- CVE-2026-103294
- CVE-2026-103820
- CVE-2026-102502
- CVE-2026-102501
- CVE-2026-48377
- CVE-2026-48378
Frequently Asked Questions
1
Can this be exploited remotely without an account or user action?
Yes. The vector is network-based, requires no privileges, and does not require user interaction.
2
What is the expected impact if exploitation succeeds?
An attacker could exhaust system resources and cause an application denial-of-service. No confidentiality or integrity impact is indicated.