CVE-2026-92823
MediumCVSS 6.2Summary
A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.
Risk Assessment
An attacker could supply a malicious file, causing resource exhaustion and denial of service for applications using libmodulemd. This may disrupt service availability.
Recommendation
Upgrade libmodulemd to a version containing the fix for this issue (contact your vendor or check the latest version).
Other vulnerabilities in libmodulemd
See all- CVE-2026-92824Medium
A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.
- CVE-2026-92822Medium
A flaw was found in libmodulemd where parsing the xmd field in module metadata lacks recursion-depth and node-count limits. A crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption.
Original NVD description (English source)
A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS