CVE-2026-100137
7.5HighPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-400
Impact
Remote, unauthenticated attackers can crash your service or trigger an application denial-of-service via resource exhaustion. They only need network access to send requests to an exposed application running CAI Content Credentials.
Root cause
The application fails to properly limit or control resource consumption during processing (CWE-400).
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade CAI Content Credentials to the fixed release specified in Adobe advisory APSB26-163. If immediate patching is not possible, place rate limits or request-size caps in front of endpoints parsing Content Credentials.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.