CVE-2026-92823

A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.

• CWE-409

• https://access.redhat.com/security/cve/CVE-2026-92823
• https://bugzilla.redhat.com/show_bug.cgi?id=2478703

Published

Oct 21, 2026

Last Modified

Oct 22, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-92816ComfyUI before 0.30.0 fails to sanitize folder_name input in…7.8
• CVE-2026-92817The Ignition Perspective module does not properly validate s…8.8
• CVE-2026-9282The W3 Total Cache plugin for WordPress is vulnerable to Dir…7.5
• CVE-2026-92820The Ninja Forms - File Uploads plugin for WordPress is vulne…8.1
• CVE-2026-92821A flaw was found in SSSD. When configured to evaluate passwo…6.8
• CVE-2026-92822A flaw was found in libmodulemd. When parsing module metadat…6.2
• CVE-2026-92824A flaw was found in libmodulemd. In the module stream v2 rpm…6.2
• CVE-2026-92826The EWWW Image Optimizer plugin for WordPress is vulnerable …6.1
• CVE-2026-92829The Blog2Social: Social Media Auto Post & Scheduler plugin f…4.3
• CVE-2026-92832IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allo…5.1
• CVE-2026-92834Use of uninitialized resource, Return of wrong status code v…6.3
• CVE-2026-92838A DLL hijacking vulnerability exists in the GeoVision GV-Rem…7.8