Denial of Service Vulnerability in libmodulemd Affects Red Hat Products
CVE-2026-92823

6.2MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat Hardened Images
Vendor
CVE Published:
21 October 2026

What is CVE-2026-92823?

A vulnerability exists in libmodulemd where the decompression of compressed modulemd YAML files may lead to excessive CPU and memory usage. This occurs due to a lack of enforced limits on the cumulative decompressed size prior to parsing, allowing an attacker to craft a specially designed compressed YAML file. Such an attack can exhaust system resources and potentially lead to denial of service. It is crucial for users and administrators to assess their usage of libmodulemd and apply any relevant security patches to safeguard their systems from potential disruptions.

References

https://access.redhat.com/security/cve/CVE-2026-92823
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2478703
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.2
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank AISLE Research for reporting this issue.
.