Vulnerability record/PUBLISHED/Published Oct 21, 2026 03:18:37 UTC
CVE-2026-92823
A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.
Base score6.2/ 10
SeverityMediumCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorLocalAV
Attack complexityLowAC
Privileges requiredNonePR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactNoneC
Integrity impactNoneI
Availability impactHighA
CVSS vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityredhat
Last updatedNov 6, 2026 01:50:20 UTC
PublishedOct 21, 2026 03:18:37 UTC
ReservedSep 16, 2026 20:31:04 UTC
Credits
- Red Hat would like to thank AISLE Research for reporting this issue.