CVE-2026-105902: 
NixOS vulnerability analysis and mitigation

CVE-2026-105902 is an Uncontrolled Resource Consumption (CWE-400) vulnerability affecting Adobe's CAI Content Credentials product suite. An unauthenticated remote attacker can exploit this flaw to exhaust system resources, resulting in an application denial-of-service condition. Affected products include the Content Credentials Rust SDK (c2pa, versions ≤ c2pa-v0.90.15), C2PA Tool (c2patool, versions ≤ c2patool-v0.27.15), and Content Credentials JS SDK (c2pa-web, versions ≤ @contentauth/c2pa-web@0.13.4). The vulnerability was published on October 13, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Adobe Advisory).

The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), meaning the affected software fails to properly control the allocation and maintenance of limited system resources when processing attacker-supplied input. The attack vector is network-based, requires no authentication, no privileges, and no user interaction, making it fully automatable. Related attack patterns include CAPEC-147 (XML Ping of the Death) and CAPEC-492 (Regular Expression Exponential Blowup), suggesting the root cause may involve unbounded processing of specially crafted input — such as malformed C2PA manifests or media files — that triggers excessive CPU or memory consumption (GitHub Advisory, Adobe Advisory).

Successful exploitation results in a denial-of-service condition, with high availability impact and no confidentiality or integrity impact. An unauthenticated network attacker can crash or render unavailable any application or service built on the affected Content Credentials Rust SDK, C2PA Tool, or Content Credentials JS SDK. Organizations relying on these libraries for digital content provenance verification — including media pipelines and content authentication workflows — may experience complete service disruption (GitHub Advisory, Adobe Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation at this time. The vulnerability is rated automatable by NVD SSVC analysis, meaning it can be exploited at scale without manual interaction. The EPSS score is approximately 0.51%, placing it in the 42nd percentile for exploitation likelihood within 30 days. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify services or applications that expose endpoints processing C2PA content credentials (e.g., media upload APIs, content verification services) built on the vulnerable Rust SDK, C2PA Tool, or JS SDK versions.
2. Craft malicious input: Prepare a specially crafted C2PA manifest or media file designed to trigger excessive resource consumption — for example, a deeply nested structure exploiting regex exponential blowup (CAPEC-492) or an oversized XML-like payload (CAPEC-147).
3. Submit payload: Send the crafted input to the target service endpoint repeatedly or in parallel, without requiring authentication or user interaction.
4. Exhaust resources: The application processes the malicious input without proper resource limits, consuming excessive CPU or memory until the service becomes unresponsive or crashes, achieving denial-of-service (GitHub Advisory, Adobe Advisory).

• Network: Unusually high volume of requests to content credential processing endpoints from a single or distributed set of IP addresses; large or malformed C2PA manifest payloads in HTTP request bodies.
• Logs: Application logs showing repeated processing errors or timeouts related to C2PA manifest parsing; resource exhaustion warnings or out-of-memory errors in service logs.
• Process: Abnormally high CPU or memory utilization by the c2patool process or Node.js/Rust-based content credentials service; service crashes or restarts correlating with inbound request spikes.
• System: OS-level alerts for memory pressure or swap exhaustion on hosts running affected SDK versions.

Adobe has released patched versions addressing this vulnerability: Content Credentials Rust SDK c2pa-v0.91.1, C2PA Tool v0.28.1, and Content Credentials JS SDK @contentauth/c2pa-web@0.15.3. Organizations should upgrade to these fixed versions as the primary remediation. As interim mitigations, implement rate limiting and resource quotas on endpoints that process C2PA content, and restrict network access to Content Credentials services to trusted sources only (Adobe Advisory, GitHub Advisory).

The vulnerability received brief coverage on social platforms including Mastodon (via @thehackerwire and @cve@infosec.exchange) shortly after disclosure, and was picked up by automated vulnerability tracking services such as cvefeed.io, vulners.com, and radar.offseq.com. AUSCERT published a bulletin (ESB-2026.12622) referencing the advisory. No significant researcher commentary or broader media coverage has been identified beyond routine vulnerability aggregation.