{"id":"CVE-2026-92822","title":"Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml","summary":"A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can …","severity":"medium","cvss":6.2,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-674"],"vendor":"Red Hat","product":"libmodulemd","affected":["libmodulemd (all versions)","libmodulemd (all versions)","libmodulemd (all versions)","libmodulemd (all versions)","openshift/ose-rhel-coreos-8 (all versions)","openshift/ose-rhel-coreos-9 (all versions)"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T03:23:10.559Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-92822","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-92822"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479002","label":"RHBZ#2479002"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T06:42:48.208Z","slug":"CVE-2026-92822","body":"## Overview\n\nA flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service.\n\n## Affected\n\n- `libmodulemd (all versions)`\n- `libmodulemd (all versions)`\n- `libmodulemd (all versions)`\n- `libmodulemd (all versions)`\n- `openshift/ose-rhel-coreos-8 (all versions)`\n- `openshift/ose-rhel-coreos-9 (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nUntil a fix is available, avoid parsing untrusted modulemd documents that may contain attacker-controlled xmd data. If such input must be accepted, reject unusually deep or large xmd structures before handing them to libmodulemd, and isolate parsing in a process with strict stack, CPU, and memory limits.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":34.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}