CVE-2026-92823
Received
Received - Intake
Modulemd YAML Parsing Denial of Service via Compression
Vulnerability report for CVE-2026-92823, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-21
Last updated on: 2026-10-21
Assigner: redhat-SADP
Description
Description
A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Red | Hat | Red Hat Enterprise Linux 10 * |
| Red | Hat | Red Hat Enterprise Linux 8 * |
| Red | Hat | Red Hat Enterprise Linux 9 * |
| Red | Hat | Red Hat Hardened Images * |
| Red | Hat | Red Hat OpenShift Container Platform 4 * |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-409 | The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output. |
