c2patool 0.27.15 hardens update-manifest traversal against parent cycles

The Content Authenticity Initiative published c2patool 0.27.15 on August 13. Its release note lists one functional change: hardening against potential deep recursion in update manifests containing parent cycles, backported from the project’s main development line.

An update manifest can refer back through parent relationships. A cycle can therefore make naive traversal revisit the same path repeatedly. The release note does not attach a CVE, severity score or exploitation claim, so the defensible description is a recursion-hardening fix rather than a confirmed security incident.

Provenance tooling is part of an ingest boundary and must tolerate malformed or adversarial structures without hanging a queue or exhausting resources. Updating the parser is useful, but a valid C2PA signature still proves a signed history and integrity relationship—not that the depicted event, caption or author claim is true.

We are watching downstream package adoption and any project advisory that adds severity or affected-version detail. Teams should test both valid manifests and deliberately cyclic or deeply nested fixtures in a resource-limited environment before changing production ingest.