{"id":"CVE-2026-113574","kind":"vulnerability","aliases":["CVE-2026-113574"],"related":[],"title":"CAI Content Credentials: uncontrolled resource use enables denial of service","description":"CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not require user interaction.","summary":"CAI Content Credentials, a library for attaching provenance metadata to content, can be made to exhaust system resources. An attacker can slow the application or deny service to it, and no user interaction is needed.","severity":"medium","cvss":4.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c2pa","content-credentials","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T22:18:22+00:00","first_seen_at":"2026-11-10T22:27:25+00:00","triaged_at":"2026-11-10T22:31:02+00:00","updated_at":"2026-11-10T22:31:02+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-10T22:31:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"CAI Content Credentials: uncontrolled resource use enables denial of service","impact":"low","summary":"CAI Content Credentials, a library for attaching provenance metadata to content, can be made to exhaust system resources. An attacker can slow the application or deny service to it, and no user interaction is needed.","audience":"developers","category":"package","nicknames":[],"who_cares":["content-credentials","c2pa"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Application slows down or stops serving requests due to resource exhaustion","analyst_note":"Confirm the affected package, registry and fixed versions from NVD or the vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-113574.","how_to_check":"unknown","plain_action":"","product_name":"CAI Content Credentials","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000653,"input_tokens":4548,"output_tokens":397,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113574':13A,16A '-2026':12A,15A 'affect':61C 'applic':45B,72C,88C 'attach':28B 'attack':41B,78C 'c2pa':17B 'cai':1A,22B,57C 'consumpt':66C 'content':2A,19B,23B,32B,58C 'content-credenti':18B 'could':69C,79C 'credenti':3A,20B,24B,59C 'cve':11A,14A 'deni':47B 'denial':8A,74C 'denial-of-servic':73C 'enabl':7A 'exhaust':37B,84C 'exploit':80C,90C 'interact':54B,98C 'issu':93C 'lead':70C 'librari':26B 'made':35B 'metadata':30B 'need':56B 'packag':21B 'proven':29B 'reduc':87C 'requir':96C 'resourc':5A,39B,65C,86C 'servic':10A,48B,76C 'slow':43B 'speed':89C 'system':38B,85C 'uncontrol':4A,64C 'use':6A 'user':53B,97C 'vulner':67C,82C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["c2pa","contentcredentials","medium","package"],"campaign_type":null,"search_a":"'-113574':13A,16A '-2026':12A,15A 'cai':1A 'content':2A 'credenti':3A 'cve':11A,14A 'denial':8A 'enabl':7A 'resourc':5A 'servic':10A 'uncontrol':4A 'use':6A","search_b":"'applic':45B 'attach':28B 'attack':41B 'c2pa':17B 'cai':22B 'content':19B,23B,32B 'content-credenti':18B 'credenti':20B,24B 'deni':47B 'exhaust':37B 'interact':54B 'librari':26B 'made':35B 'metadata':30B 'need':56B 'packag':21B 'proven':29B 'resourc':39B 'servic':48B 'slow':43B 'system':38B 'user':53B","search_c":"'affect':61C 'applic':72C,88C 'attack':78C 'cai':57C 'consumpt':66C 'content':58C 'could':69C,79C 'credenti':59C 'denial':74C 'denial-of-servic':73C 'exhaust':84C 'exploit':80C,90C 'interact':98C 'issu':93C 'lead':70C 'reduc':87C 'requir':96C 'resourc':65C,86C 'servic':76C 'speed':89C 'system':85C 'uncontrol':64C 'user':97C 'vulner':67C,82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113574","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113574","severity":null,"published_at":"2026-11-10T22:18:22+00:00","modified_at":"2026-11-10T22:18:22+00:00","first_seen_at":"2026-11-10T22:27:25+00:00","fetched_at":"2026-11-10T22:27:25+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}