What happened
The Content Authenticity Initiative published c2patool 0.27.15 on August 13. Its release note lists one functional change: hardening against potential deep recursion in update manifests containing parent cycles, backported from the project’s main development line.
An update manifest can refer back through parent relationships. A cycle can therefore make naive traversal revisit the same path repeatedly. The release note does not attach a CVE, severity score or exploitation claim, so the defensible description is a recursion-hardening fix rather than a confirmed security incident.
Why it matters
Provenance tooling is part of an ingest boundary and must tolerate malformed or adversarial structures without hanging a queue or exhausting resources. Updating the parser is useful, but a valid C2PA signature still proves a signed history and integrity relationship—not that the depicted event, caption or author claim is true.
What we're watching
We are watching downstream package adoption and any project advisory that adds severity or affected-version detail. Teams should test both valid manifests and deliberately cyclic or deeply nested fixtures in a resource-limited environment before changing production ingest.