CVE-2026-92822
CVE-2026-92822 · Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service.
CVSS 6.2 · Medium · EPSS 0.1%
- Published
- Updated
Stack: system
Affected products and versions
red hat enterprise linux 10
No fix published
red hat enterprise linux 8
No fix published
red hat enterprise linux 9
No fix published
red hat hardened images
No fix published
red hat openshift container platform 4
No fix published
libmodulemd Debian:12
- Versions
- 2.14.0-3
- 2.15.0-1
- 2.15.2-1
- 2.15.2-2
- 2.15.2-3
- 2.15.2-4
- 2.15.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmodulemd Debian:13
- Versions
- 2.15.0-1
- 2.15.2-1
- 2.15.2-2
- 2.15.2-3
- 2.15.2-4
- 2.15.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmodulemd Debian:14
- Versions
- 2.15.0-1
- 2.15.2-1
- 2.15.2-2
- 2.15.2-3
- 2.15.2-4
- 2.15.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmodulemd Ubuntu:22.04:LTS
- Versions
- 2.12.0-1
- 2.13.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmodulemd Ubuntu:24.04:LTS
- Versions
- 2.14.0-3
- 2.14.0-3build1
- 2.14.0-3build2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmodulemd Ubuntu:26.10
- Versions
- 2.15.2-3
- 2.15.2-4
- 2.15.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmodulemd Ubuntu:26.04:LTS
- Versions
- 2.15.0-1
- 2.15.2-1
- 2.15.2-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published