Medium
6.2
A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into...
CVE-2026-92822
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-92822 libmodulemd
Original description The description as published by the source.
A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service.
Source: NIST National Vulnerability Database NVD GitHub Advisory
References
- web secalert@redhat.com
- web bugzilla.redhat.com
- web nvd.nist.gov
- web github.com