CVE-2026-92822

A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service.

This Moderate flaw is an availability-only denial of service in libmodulemd. Exploitation requires a consumer to parse attacker-controlled modulemd YAML containing a deeply nested xmd structure. Environments that only ingest trusted module metadata are not practically exposed. Confidentiality and integrity impact were not established.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Until a fix is available, avoid parsing untrusted modulemd documents that may contain attacker-controlled xmd data. If such input must be accepted, reject unusually deep or large xmd structures before handing them to libmodulemd, and isolate parsing in a process with strict stack, CPU, and memory limits.