CVE-2026-34677

Full vulnerability record from the local CVENow database.

Description

CAI Content Credentials versions [email protected], c2pa-v0.78.2 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

Severity

MEDIUM

CVSS score

6.2 (v3.1)

Vulnerability status

Modified

Source identifier

[email protected]

Published

2026-05-12 20:16:38.033000

Last modified

2026-10-26 18:10:00.173000

View original CVE JSON

{
  "id": "CVE-2026-34677",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-12T20:16:38.033",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "CAI Content Credentials versions [email protected], c2pa-v0.78.2 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction."
    },
    {
      "lang": "es",
      "value": "Las versiones 0.78.2, 0.7.0 y anteriores de CAI Content Credentials se ven afectadas por una vulnerabilidad de Consumo de Recursos No Controlado que podría conducir a una denegación de servicio de la aplicación. Un atacante podría explotar esta vulnerabilidad para agotar los recursos del sistema, lo que resultaría en una condición de denegación de servicio de la aplicación. La explotación de este problema no requiere interacción del usuario."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Adobe",
          "product": "Content Credentials JS SDK",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "@contentauth/[email protected]",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "@contentauth/[email protected]",
              "versionType": "custom",
              "status": "unaffected"
            }
          ]
        },
        {
          "vendor": "Adobe",
          "product": "Content Credentials Rust SDK",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "c2pa-v0.78.2",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "c2pa-v0.80.1",
              "versionType": "custom",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 6.2,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-12T20:22:47.034254Z",
          "id": "CVE-2026-34677",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:adobe:c2pa:*:*:*:*:*:rust:*:*",
              "versionEndExcluding": "0.80.1",
              "matchCriteriaId": "582660A2-9085-4450-AE1C-4ADF5604E636"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:adobe:c2pa-web:*:*:*:*:*:node.js:*:*",
              "versionEndExcluding": "0.7.1",
              "matchCriteriaId": "1EF9A61D-7F17-4AF9-B9EF-440D38A11D9F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-53.html",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}