CVE-2026-92823

Awaiting Analysis Awaiting Analysis - Queue

Modulemd YAML Parsing Denial of Service via Compression

Publication date: 2026-10-21

Last updated on: 2026-11-06

Assigner: redhat-SADP

Description

A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-11-06

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-92823

EUVD

EUVD-2026-107036

Affected Vendors & Products

Vendor	Product	Version / Range
Red Hat	Red Hat Enterprise Linux 10	*
Red Hat	Red Hat Enterprise Linux 8	*
Red Hat	Red Hat Enterprise Linux 9	*
Red Hat	Red Hat Hardened Images	*
Red Hat	Red Hat OpenShift Container Platform 4	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-409	The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial-of-service flaw in libmodulemd where compressed YAML files are decompressed without enforcing a size limit. An attacker can provide a highly compressible file that expands massively during decompression, consuming excessive CPU and memory. This only affects builds with rpmio support enabled and requires the system to parse attacker-controlled compressed module metadata.

Detection Guidance

To detect this vulnerability, monitor for excessive CPU or memory usage during decompression of compressed YAML files in libmodulemd. Check if your system uses rpmio-enabled builds of libmodulemd by inspecting installed versions and build configurations.

Impact Analysis

If you use a vulnerable system with rpmio support enabled, an attacker could cause your system to slow down or crash by providing a specially crafted compressed YAML file. This could disrupt services relying on libmodulemd, such as modulemd-validator or API functions processing module metadata.

Compliance Impact

This vulnerability primarily impacts system availability by causing excessive CPU and memory consumption through a denial-of-service attack. It does not directly affect confidentiality or integrity of data, which are key concerns for GDPR and HIPAA compliance. However, prolonged unavailability of systems due to DoS could potentially lead to non-compliance with availability requirements in these regulations.

Mitigation Strategies

Avoid parsing attacker-controlled compressed module metadata in rpmio-enabled builds of libmodulemd.
Implement strict size quotas during decompression to prevent resource exhaustion.
Disable rpmio support in libmodulemd builds if possible.
Update to patched versions of libmodulemd once fixes are released by Red Hat.

Hi! I’m here to help you understand CVE-2026-92823. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...