CVE-2026-100138
7.5HighPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-400
Impact
Remote, unauthenticated attackers can crash or hang the application via denial-of-service without user interaction. They only need network access to any endpoint processing CAI Content Credentials.
Root cause
The application fails to control resource consumption when processing incoming content credentials, exhausting system memory or CPU.
Affected systems
CAI Content Credentials (exact affected versions not listed — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Check the vendor advisory at APSB26-163 for the patched SDK version and update dependencies; if immediate patching is not possible, restrict untrusted network access to endpoints handling Content Credentials.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.