CVE-2026-92823 in Red Hat
Summary
by MITRE • 10/22/2026
A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified within libmodulemd represents a significant resource exhaustion flaw arising from the handling of compressed module metadata files when rpmio support is enabled. In this specific configuration, the library utilizes a custom read handler to decompress YAML content prior to parsing it into internal data structures. The core technical deficiency lies in the absence of a cumulative size limit check on the decompressed output before the parsing process begins. This design oversight allows an attacker who can supply or influence the input file to exploit the disparity between compressed and uncompressed sizes, leading to severe system instability.
This flaw is categorized under CWE-400, which describes Uncontrolled Resource Consumption, specifically manifesting as a Denial of Service through resource exhaustion. The attack vector relies on crafting highly compressible data that expands significantly when decompressed. By submitting such a file, an adversary can force the application to allocate excessive amounts of memory and CPU cycles during the decomposition phase. This behavior aligns with ATT&CK technique T1496, Resource Hijacking, where resources are consumed to degrade service availability for legitimate users or other processes on the system.
The operational impact of this vulnerability is primarily a denial of service condition. When the application attempts to process the maliciously crafted file, it will consume disproportionate amounts of memory and processing power as it expands the compressed stream without bounds. This can lead to the freezing of the affected application, crashes due to out-of-memory errors, or broader system degradation if the resource consumption affects shared resources on a multi-tenant environment. In contexts where libmodulemd is used by package managers like DNF or RPM, this could disrupt software installation and update processes for all users on the system.
Mitigation strategies should focus on implementing strict limits on decompressed data size within the custom read handler. Developers must enforce a maximum allowable byte count for the uncompressed YAML content before allowing it to be parsed. Additionally, input validation mechanisms should be strengthened to detect anomalously high compression ratios that may indicate an attack attempt. Updating libmodulemd to a patched version that includes these safeguards is essential for restoring secure operation and preventing exploitation of this resource exhaustion flaw.