« Volver al listado

CVE-2026-47905

Estado: AnalizadaMedia (6.2)—

CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consumption vulnerability. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Adobe — C2paAdobe — C2pa-web

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-47905",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-47905",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-10T13:54:17.559683Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@adobe.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.2,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.5
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@adobe.com",
      "affectedData": [
        {
          "vendor": "Adobe",
          "product": "Content Credentials Rust SDK",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "c2pa-v0.80.1"
            },
            {
              "status": "unaffected",
              "version": "c2pa-v0.85.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Adobe",
          "product": "Content Credentials JS SDK",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "@contentauth/c2pa-web@0.7.1"
            },
            {
              "status": "unaffected",
              "version": "@contentauth/c2pa-web@0.8.3",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-09T22:16:25.517",
  "references": [
    {
      "url": "https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-61.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@adobe.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@adobe.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consumption vulnerability. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction."
    },
    {
      "lang": "es",
      "value": "Las versiones c2pa-web@0.7.1, c2pa-v0.80.1 y anteriores de CAI Content Credentials se ven afectadas por una vulnerabilidad de Consumo de Recursos No Controlado. Un atacante podría explotar esta vulnerabilidad para agotar los recursos del sistema, lo que resultaría en una condición de denegación de servicio de la aplicación. La explotación de este problema no requiere interacción del usuario."
    }
  ],
  "lastModified": "2026-08-28T00:17:28.600",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adobe:c2pa:*:*:*:*:*:rust:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FAC5EB4E-D740-4724-82DA-7C49F0138397",
              "versionEndIncluding": "0.80.1"
            },
            {
              "criteria": "cpe:2.3:a:adobe:c2pa-web:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4402A37D-5CCD-46EB-8942-3BA694C3F770",
              "versionEndIncluding": "0.7.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@adobe.com"
}