Live › vulnerability › CVE-2026-92823
Go to dashboardlibmodulemd, a library for parsing Fedora/RHEL modulemd metadata, does not cap the total decompressed size of compressed YAML in builds with rpmio support. A crafted, highly compressible file can exhaust CPU and memory on the parsing host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only builds compiled with rpmio support parse compressed modulemd YAML through the affected read handler, so the exposure depends on that build option and on the code path that feeds untrusted compressed metadata to the library. Systems that only parse trusted local modulemd files, or that use builds without rpmio, are unlikely to be affected. unknown whether the sources name specific distributions or package versions.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-92823")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.