{"id":"CVE-2026-92823","kind":"vulnerability","aliases":["CVE-2026-92823"],"related":[],"title":"libmodulemd: unbounded decompression of compressed YAML causes denial of service","description":"A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.","summary":"libmodulemd, a library for parsing Fedora/RHEL modulemd metadata, does not cap the total decompressed size of compressed YAML in builds with rpmio support. A crafted, highly compressible file can exhaust CPU and memory on the parsing host.","severity":"medium","cvss":6.2,"epss":0.00117,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["build-tooling","libmodulemd","package","rpm-based-distros"],"not_affected_if":["default-config","trusted-input-only"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-21T04:18:12+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:02:01+00:00","updated_at":"2026-10-25T04:02:01+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:02:01Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"libmodulemd: unbounded decompression of compressed YAML causes denial of service","impact":"low","summary":"libmodulemd, a library for parsing Fedora/RHEL modulemd metadata, does not cap the total decompressed size of compressed YAML in builds with rpmio support. A crafted, highly compressible file can exhaust CPU and memory on the parsing host.","category":"package","nicknames":[],"who_cares":["libmodulemd","rpm-based-distros","build-tooling"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Denial of service through CPU and memory exhaustion while parsing.","analyst_note":"Find the fixed libmodulemd release and the distro advisories at the NVD entry, and confirm which builds enable rpmio.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["default-config","trusted-input-only"],"who_is_affected":"Only builds compiled with rpmio support parse compressed modulemd YAML through the affected read handler, so the exposure depends on that build option and on the code path that feeds untrusted compressed metadata to the library. Systems that only parse trusted local modulemd files, or that use builds without rpmio, are unlikely to be affected. unknown whether the sources name specific distributions or package versions.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000588,"input_tokens":3353,"output_tokens":505,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-92823':13A,16A 'attack':98C 'base':24B 'build':18B,45B,70C 'build-tool':17B 'cap':36B 'caus':7A,109C 'compress':5A,42B,52B,75C,104C,105C 'consumpt':114C 'cpu':56B,111C 'craft':50B 'cumul':90C 'custom':82C 'cve':11A,14A 'decompress':3A,39B,79C,92C 'decompressed-s':91C 'denial':8A,118C 'distro':25B 'enabl':74C 'enforc':88C 'excess':110C 'exhaust':55B 'fedora/rhel':31B 'file':53B,107C 'flaw':64C 'found':66C 'handler':84C 'high':51B,103C 'host':62B 'libmodulemd':1A,20B,26B,68C 'librari':28B 'limit':94C 'memori':58B,113C 'metadata':33B 'modulemd':32B,76C 'packag':21B 'pars':30B,61B,96C 'read':83C 'result':115C 'rpm':23B 'rpm-based-distro':22B 'rpmio':47B,72C 'servic':10A,120C 'size':40B,93C 'suppli':101C 'support':48B,73C 'tool':19B 'total':38B 'unbound':2A 'yaml':6A,43B,77C,106C","nicknames":[],"mitigations":[],"who_affected":"Only builds compiled with rpmio support parse compressed modulemd YAML through the affected read handler, so the exposure depends on that build option and on the code path that feeds untrusted compressed metadata to the library. Systems that only parse trusted local modulemd files, or that use builds without rpmio, are unlikely to be affected. unknown whether the sources name specific distributions or package versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T04:18:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92823","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92823","severity":null,"published_at":"2026-10-21T04:18:12+00:00","modified_at":"2026-10-22T15:25:35+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-92823","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92823","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}