What’s Vulnerable › Vulnerabilities

CVE-2026-92822: Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml

• Severity: medium (CVSS 6.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-21 · updated 2026-10-22
• Weakness: CWE-674

Description

A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service.

Affected products

• Red Hat OpenShift Container Platform 4.18: all versions
• Red Hat Enterprise Linux 10: all versions
• Red Hat Enterprise Linux 8: all versions
• Red Hat Enterprise Linux 9: all versions
• Red Hat Hardened Images: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-92822
• https://bugzilla.redhat.com/show_bug.cgi?id=2479002
• https://bugzilla.redhat.com/show_bug.cgi?id=2479002

Get alerted when CVE-2026-92822 or the next vulnerability affects your stack