{"id":"DEBIAN-CVE-2026-92822","details":"A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service.","modified":"2026-10-22T05:00:11.320162861Z","published":"2026-10-21T14:47:31.237250913Z","upstream":["CVE-2026-92822"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-92822"}],"affected":[{"package":{"name":"libmodulemd","ecosystem":"Debian:12","purl":"pkg:deb/debian/libmodulemd?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0-3","2.15.0-1","2.15.2-1","2.15.2-2","2.15.2-3","2.15.2-4","2.15.3-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-92822.json"}},{"package":{"name":"libmodulemd","ecosystem":"Debian:13","purl":"pkg:deb/debian/libmodulemd?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.15.0-1","2.15.2-1","2.15.2-2","2.15.2-3","2.15.2-4","2.15.3-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-92822.json"}},{"package":{"name":"libmodulemd","ecosystem":"Debian:14","purl":"pkg:deb/debian/libmodulemd?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.15.0-1","2.15.2-1","2.15.2-2","2.15.2-3","2.15.2-4","2.15.3-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-92822.json"}}],"schema_version":"1.9.0"}