CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier expose an uncontrolled resource consumption flaw that allows an attacker to drain system memory and CPU, leading to a denial‑of‑service condition. The weakness is classified as CWE‑400, reflecting excessive and uncontrolled resource usage. Attacks require no user interaction; a remote actor can trigger the denial simply by sending crafted requests.

Adobe CAI Content Credentials is the affected product. Versions c2pa-web@0.7.1, c2pa-v0.80.1 and any older releases are vulnerable. End‑points running these versions, when exposed to potential attackers, are at risk of experiencing service disruption.

The CVSS score of 6.2 places the issue in the medium severity range. While the EPSS score is not available, the lack of user interaction and the straightforward resource exhaustion nature suggest that automated exploitation could be feasible. The vulnerability is not currently listed in the CISA KEV catalog, but organizations should still treat it as a potential threat, especially if the affected components are exposed to untrusted inputs.