Denial of Service Vulnerability in libmodulemd by Red Hat
CVE-2026-92822

6.2MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat Hardened Images
Vendor
CVE Published:
21 October 2026

What is CVE-2026-92822?

A flaw exists in libmodulemd that allows an attacker to exploit the xmd field during the parsing of module metadata. By supplying crafted modulemd YAML with excessively nested xmd content, the vulnerability creates a condition that can lead to stack exhaustion or significant resource consumption. This subsequently results in a denial of service, essentially affecting the availability of the service reliant on the libmodulemd library.

References

https://access.redhat.com/security/cve/CVE-2026-92822
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2479002
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.2
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank AISLE Research for reporting this issue.
.