{"id":"CVE-2026-122097","kind":"vulnerability","aliases":["CVE-2026-122097"],"related":[],"title":"CAI Content Credentials: resource exhaustion lets a crafted page crash the app","description":"CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.","summary":"CAI Content Credentials can be made to consume system resources without limit when a victim opens a crafted URL or visits a compromised web page. The result is an application denial-of-service, not code execution or data theft.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"CAI Content Credentials","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["c2pa","content-credentials","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T22:18:28+00:00","first_seen_at":"2026-11-10T22:27:28+00:00","triaged_at":"2026-11-10T22:29:14+00:00","updated_at":"2026-11-10T22:29:14+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T22:29:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"CAI Content Credentials: resource exhaustion lets a crafted page crash the app","impact":"low","summary":"CAI Content Credentials can be made to consume system resources without limit when a victim opens a crafted URL or visits a compromised web page. The result is an application denial-of-service, not code execution or data theft.","audience":"businesses","category":"other","nicknames":[],"who_cares":["content-credentials","c2pa"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"application stops responding to users until restarted","analyst_note":"Find the vendor advisory and affected/fixed versions for CVE-2026-122097 and which deployments run the CAI SDK or viewer.","how_to_check":"unknown","plain_action":"","product_name":"CAI Content Credentials","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000649,"input_tokens":4583,"output_tokens":381,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-122097':15A,18A '-2026':14A,17A 'affect':70C 'app':12A 'applic':55B,81C,99C 'attack':87C 'c2pa':22B 'cai':1A,19A,26B,66C 'code':61B 'compromis':48B,126C 'condit':104C 'consum':33B 'consumpt':75C 'content':2A,20A,24B,27B,67C 'content-credenti':23B 'could':78C,88C 'craft':8A,43B,120C 'crash':10A 'credenti':3A,25B,28B,68C 'credentials':21A 'cve':13A,16A 'data':64B 'denial':57B,83C,101C 'denial-of-servic':56B,82C,100C 'execut':62B 'exhaust':5A,93C 'exploit':89C,105C 'interact':111C,123C 'issu':108C 'lead':79C 'let':6A 'limit':37B 'made':31B 'malici':119C 'must':116C 'open':41B 'page':9A,50B,128C 'requir':109C 'resourc':4A,35B,74C,95C 'result':52B,96C 'servic':59B,85C,103C 'system':34B,94C 'theft':65B 'uncontrol':73C 'url':44B,121C 'user':110C 'victim':40B,115C 'visit':46B,117C 'vulner':76C,91C 'web':49B,127C 'without':36B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["caicontentcredentials","contentcredentials"],"ptokens":["cai","content","credentials"],"labels":["c2pa","contentcredentials","medium","other","vendor"],"campaign_type":null,"search_a":"'-122097':15A,18A '-2026':14A,17A 'app':12A 'cai':1A,19A 'content':2A,20A 'craft':8A 'crash':10A 'credenti':3A 'credentials':21A 'cve':13A,16A 'exhaust':5A 'let':6A 'page':9A 'resourc':4A","search_b":"'applic':55B 'c2pa':22B 'cai':26B 'code':61B 'compromis':48B 'consum':33B 'content':24B,27B 'content-credenti':23B 'craft':43B 'credenti':25B,28B 'data':64B 'denial':57B 'denial-of-servic':56B 'execut':62B 'limit':37B 'made':31B 'open':41B 'page':50B 'resourc':35B 'result':52B 'servic':59B 'system':34B 'theft':65B 'url':44B 'victim':40B 'visit':46B 'web':49B 'without':36B","search_c":"'affect':70C 'applic':81C,99C 'attack':87C 'cai':66C 'compromis':126C 'condit':104C 'consumpt':75C 'content':67C 'could':78C,88C 'craft':120C 'credenti':68C 'denial':83C,101C 'denial-of-servic':82C,100C 'exhaust':93C 'exploit':89C,105C 'interact':111C,123C 'issu':108C 'lead':79C 'malici':119C 'must':116C 'page':128C 'requir':109C 'resourc':74C,95C 'result':96C 'servic':85C,103C 'system':94C 'uncontrol':73C 'url':121C 'user':110C 'victim':115C 'visit':117C 'vulner':76C,91C 'web':127C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122097","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122097","severity":null,"published_at":"2026-11-10T22:18:28+00:00","modified_at":"2026-11-10T22:18:28+00:00","first_seen_at":"2026-11-10T22:27:28+00:00","fetched_at":"2026-11-10T22:27:28+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}