CVE-2026-92823 Red Hat CVE debrief

Who should care

Defenders responsible for Red Hat Enterprise Linux 8, 9, 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 and 5 should assess exposure and prioritize verification and updates.

Why it matters

The flaw in libmodulemd allows for a denial of service through highly compressible compressed YAML files, affecting Red Hat Enterprise Linux 8, 9, 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 and 5. Defenders should prioritize verification and updates.

• Denial of service through excessive CPU and memory consumption
• Potential for increased latency and resource utilization
• Need for verification of libmodulemd versions and updates
• Possible impact on system availability and performance

Technical summary

The libmodulemd library does not enforce a cumulative decompressed-size limit when parsing compressed modulemd YAML files. This allows an attacker to supply a highly compressible compressed YAML file, causing excessive CPU and memory consumption, resulting in a denial of service. The issue is particularly relevant for deployments using Red Hat Enterprise Linux 8, 9, 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 and 5. Defenders should prioritize verifying and updating libmodulemd versions.

Defensive priority

Defenders should prioritize verifying and updating libmodulemd versions in Red Hat Enterprise Linux 8, 9, 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 and 5.

Recommended defensive actions

• Verify libmodulemd versions in Red Hat Enterprise Linux 8, 9, 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 and 5
• Update libmodulemd to the latest version
• Monitor for highly compressible compressed YAML files
• Implement cumulative decompressed-size limits for parsing compressed YAML
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the flaw in libmodulemd. Specific versions affected and remediation steps require verification from official Red Hat sources. The flaw is related to the parsing of compressed YAML files without a cumulative decompressed-size limit. Evidence from the CVE Program and NVD detail pages supports the denial of service potential. However, detailed version information and specific patches require direct verification from Red Hat.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.