CVE-2026-92823
CVE-2026-92823 · Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.
CVSS 6.2 · Medium · EPSS 0.1%
- Published
- Updated
Stack: system
Affected products and versions
red hat enterprise linux 10
No fix published
red hat enterprise linux 8
No fix published
red hat enterprise linux 9
No fix published
red hat hardened images
No fix published
red hat openshift container platform 4
No fix published
libmodulemd Debian:12
- Versions
- 2.14.0-3
- 2.15.0-1
- 2.15.2-1
- 2.15.2-2
- 2.15.2-3
- 2.15.2-4
- 2.15.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmodulemd Debian:13
- Versions
- 2.15.0-1
- 2.15.2-1
- 2.15.2-2
- 2.15.2-3
- 2.15.2-4
- 2.15.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmodulemd Debian:14
- Versions
- 2.15.0-1
- 2.15.2-1
- 2.15.2-2
- 2.15.2-3
- 2.15.2-4
- 2.15.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmodulemd Ubuntu:22.04:LTS
- Versions
- 2.12.0-1
- 2.13.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmodulemd Ubuntu:24.04:LTS
- Versions
- 2.14.0-3
- 2.14.0-3build1
- 2.14.0-3build2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmodulemd Ubuntu:26.10
- Versions
- 2.15.2-3
- 2.15.2-4
- 2.15.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmodulemd Ubuntu:26.04:LTS
- Versions
- 2.15.0-1
- 2.15.2-1
- 2.15.2-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published