CVE-2026-92823
Medium · 6.2CVSS
6.2
EPSS
0.1%
Published
Oct 21, 2026
CISA due date
—
The record
A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-112892 Pillow is a Python imaging library. CWE-409
- CVE-2026-107227 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-409
- CVE-2026-107210 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-409
- CVE-2026-106585 In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet… CWE-409
- CVE-2026-84384 libheif is a HEIF and AVIF file format decoder and encoder. CWE-409
- CVE-2026-44162 fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. CWE-409
- CVE-2026-85786 Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow… CWE-409
- CVE-2026-84382 HTTPX2 is a next generation HTTP client for Python. CWE-409