CVE-2026-92822

Overview

CVE-2026-92822 is a denial‑of‑service vulnerability in libmodulemd that allows an attacker to supply deeply nested YAML in the xmd field, causing stack exhaustion or excessive resource consumption during module metadata parsing. The flaw can be triggered by any component that processes modulemd files, such as package managers or container build tools. It does not directly compromise confidentiality or integrity, but it can render affected systems unavailable.

Description

A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service.

Impact

The vulnerability leads to a loss of availability for systems that parse modulemd files, potentially causing service outages or degraded performance. It affects all users of libmodulemd, including administrators, developers, and automated build pipelines. The impact is limited to the affected host and does not expose data or alter system state.

Remediation

Apply the latest libmodulemd update that limits recursion depth or node count when parsing the xmd field. If an update is not yet available, restrict the size of YAML inputs, enforce memory and CPU quotas for processes that load modulemd, and monitor for abnormal memory usage. As a temporary measure, disable or sandbox untrusted modulemd parsing where possible.

Risk context

The CVE has a medium severity score (CVSS 6.2) and no EPSS data is available. While it does not enable direct compromise, the potential for denial of service warrants timely patching or mitigation to maintain service availability.

Affected products

• Red Hat Enterprise Linux
• Fedora
• CentOS
• SUSE Linux Enterprise
• Debian
• Ubuntu
• OpenSUSE
• Oracle Linux