CVE-2026-105902
7.5HighPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-400
Impact
Remote unauthenticated attackers can crash the application and cause a denial of service by exhausting system resources. They only need network access to send requests to the service without requiring user interaction.
Root cause
The application fails to restrict resource consumption properly, leading to uncontrolled allocation when processing inputs.
Affected systems
CAI Content Credentials; versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade CAI Content Credentials to the patched release referenced in Adobe advisory APSB26-163. If immediate patching is not possible, restrict network access to the service or place it behind a rate-limiting proxy.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.