{"id":"CVE-2026-92824","kind":"vulnerability","aliases":["CVE-2026-92824"],"related":[],"title":"libmodulemd: crafted module metadata crashes YAML serialization via out-of-bounds read","description":"A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.","summary":"libmodulemd, the library that reads and writes Fedora and RHEL module metadata, has an inner loop in the rpm-map emission path that uses the wrong bound. Crafted modulemd v2 metadata with multiple digest types can cause an out-of-bounds read that typically crashes the process, a denial of service.","severity":"medium","cvss":6.2,"epss":0.00117,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fedora","libmodulemd","package","rhel","rpm-repositories"],"not_affected_if":["no-untrusted-modulemd-input"],"how_to_check":"- `pkg-config --modversion modulemd-2.0` to see the installed libmodulemd version\n- `rpm -q libmodulemd` on Fedora or RHEL systems\n- Check whether any service parses untrusted modulemd v2 metadata with libmodulemd","fix":null,"status":"open","published_at":"2026-10-21T04:18:12+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:02:02+00:00","updated_at":"2026-10-25T04:02:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:02:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"libmodulemd: crafted module metadata crashes YAML serialization via out-of-bounds read","impact":"low","summary":"libmodulemd, the library that reads and writes Fedora and RHEL module metadata, has an inner loop in the rpm-map emission path that uses the wrong bound. Crafted modulemd v2 metadata with multiple digest types can cause an out-of-bounds read that typically crashes the process, a denial of service.","category":"package","nicknames":[],"who_cares":["libmodulemd","fedora","rhel","rpm-repositories"],"confidence":0.6,"needs_auth":"unknown","worst_case":"process crashes during YAML serialization, causing denial of service","analyst_note":"Find the fixed libmodulemd version and the upstream commit or distro errata for CVE-2026-92824 via the NVD page and distro trackers.","how_to_check":"- `pkg-config --modversion modulemd-2.0` to see the installed libmodulemd version\n- `rpm -q libmodulemd` on Fedora or RHEL systems\n- Check whether any service parses untrusted modulemd v2 metadata with libmodulemd","needs_analyst":true,"not_affected_if":["no-untrusted-modulemd-input"],"who_is_affected":"Only systems that run libmodulemd to parse or serialize modulemd v2 metadata from sources a user can influence, such as repository builds or uploaded module files. Systems that only consume trusted, locally built metadata are unlikely to see a crash from an attacker. The sources do not name fixed versions.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000633,"input_tokens":3365,"output_tokens":593,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-92824':16A,19A 'algorithm':105C 'bound':12A,54B,69B,108C,134C 'caus':64B,140C 'checksum':114C 'count':102C 'craft':2A,55B,120C 'crash':5A,73B,142C 'current':117C 'cve':14A,17A 'denial':77B,147C 'digest':61B,104C,118C,126C 'emiss':48B,94C 'fedora':20B,34B 'flaw':81C 'found':83C 'incorrect':99C 'inner':41B,97C 'instead':109C 'libmodulemd':1A,21B,27B,85C 'librari':29B 'loop':42B,98C 'map':47B,93C 'metadata':4A,38B,58B,123C 'modul':3A,37B,88C 'modulemd':56B,121C 'multipl':60B,125C 'number':112C 'out-of-bound':9A,66B,131C 'packag':22B 'path':49B,95C 'process':75B 'read':13A,31B,70B,135C 'repositori':26B 'result':144C 'rhel':23B,36B 'rpm':25B,46B,92C 'rpm-map':45B,91C 'rpm-repositori':24B 'serial':7A,138C 'servic':79B,149C 'stream':89C 'tabl':119C 'trigger':129C 'type':62B,127C 'typic':72B,139C 'use':51B,100C 'v2':57B,90C,122C 'via':8A 'write':33B 'wrong':53B 'yaml':6A,137C","nicknames":[],"mitigations":[],"who_affected":"Only systems that run libmodulemd to parse or serialize modulemd v2 metadata from sources a user can influence, such as repository builds or uploaded module files. Systems that only consume trusted, locally built metadata are unlikely to see a crash from an attacker. The sources do not name fixed versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T04:18:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92824","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92824","severity":null,"published_at":"2026-10-21T04:18:12+00:00","modified_at":"2026-10-22T15:25:35+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-92824","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92824","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}