CVE-2026-92822
MediumCVSS 6.2Summary
A flaw was found in libmodulemd where parsing the xmd field in module metadata lacks recursion-depth and node-count limits. A crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption.
Risk Assessment
An attacker can remotely supply crafted module metadata and cause a denial of service (DoS) in the application or system processing it.
Recommendation
Update libmodulemd to a version that enforces recursion-depth and node-count limits when parsing xmd. Until patched, avoid processing untrusted modulemd YAML files.
Other vulnerabilities in libmodulemd
See all- CVE-2026-92824Medium
A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.
- CVE-2026-92823Medium
A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.
Original NVD description (English source)
A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS