Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-92822— Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml

Quick assessment

Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 libmodulemd 中发现了一个漏洞。在解析模块元数据时，xmd 字段会通过递归的 YAML 映射和序列辅助函数转换为嵌套的 GVariant 值，但该过程未设置递归深度或节点数量的限制。如果攻击者能够提供包含深度嵌套 xmd 内容的特制 modulemd YAML 文件，则可能导致栈耗尽或资源过度消耗，从而引发拒绝服务（DoS）。

CVSS 6.2 · Medium

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-92822

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的递归
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Enterprise Linux 10 - cpe:/o:redhat:enterprise_linux:10
Red Hat Red Hat Enterprise Linux 8 - cpe:/o:redhat:enterprise_linux:8
Red Hat Red Hat Enterprise Linux 9 - cpe:/o:redhat:enterprise_linux:9
Red Hat Red Hat Hardened Images - cpe:/a:redhat:hummingbird:1
Red Hat Red Hat OpenShift Container Platform 4 - cpe:/a:redhat:openshift:4
Red Hat Red Hat OpenShift Container Platform 4 - cpe:/a:redhat:openshift:4

II. Public POCs for CVE-2026-92822

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-92822

请登录查看更多情报信息。

Other References for CVE-2026-92822 (2)

Same Patch Batch · Red Hat · 2026-10-21 · 4 CVEs total

CVE-2026-92824 6.2 MEDIUM Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts
CVE-2026-92823 6.2 MEDIUM Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml
CVE-2026-114038 5.1 MEDIUM Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed for

IV. Related Vulnerabilities

Same product: Red Hat Enterprise Linux 10
Same vendor: Red Hat
Same weakness: CWE-674

V. Comments for CVE-2026-92822

No comments yet

Leave a comment