Medium
6.2
A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML...
CVE-2026-92823
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-92823 libmodulemd
Original description The description as published by the source.
A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.
Source: NIST National Vulnerability Database NVD GitHub Advisory
References
- web secalert@redhat.com
- web secalert@redhat.com
- web nvd.nist.gov
- web github.com