CVE-2026-92822 Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml

Medium 6.2 Published 21 Oct 2026 Updated 21 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-92822?

CVE-2026-92822 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, published on 21 Oct 2026.

Official description

A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service.

Weakness: CWE-674

Which versions are affected by CVE-2026-92822?

How do I fix CVE-2026-92822?

No fix has been published for CVE-2026-92822 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-92822 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92822 exists.

Sources

Also known as DEBIAN-CVE-2026-92822, GHSA-85r9-7wj5-x6x5, UBUNTU-CVE-2026-92822.