CVE-2026-92823

A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.

This Moderate flaw is an availability-only denial of service in libmodulemd. Exploitation depends on an rpmio-enabled build and on a consumer accepting attacker-controlled compressed module metadata. Environments that do not parse untrusted compressed modulemd input are not practically exposed. Confidentiality and integrity impact were not established.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Until a fix is available, avoid parsing attacker-controlled compressed module metadata in rpmio-enabled builds. Where compressed input is required, decompress outside the process under strict size quotas, or reject files whose decompressed size exceeds a conservative limit before passing data to libmodulemd. Building without rpmio support removes the affected path.