CVE-2026-92823: Improper Handling of Highly Compressed Data (Data Amplification) in Red Hat Red Hat Enterprise Linux 10

The vulnerability in libmodulemd arises because the custom read handler decompressing compressed modulemd YAML does not enforce a cumulative decompressed-size limit before parsing. This allows an attacker who can supply a highly compressible compressed YAML file to cause excessive resource consumption (CPU and memory), resulting in denial of service. The issue affects builds with rpmio support enabled on Red Hat Enterprise Linux 10. The CVSS 3.1 score is 6.2 (medium severity) with vector AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. No known exploits are reported in the wild.

The impact is denial of service due to excessive CPU and memory consumption when processing specially crafted compressed YAML files. There is no impact on confidentiality or integrity. The attack requires local access to supply the malicious file.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-92823 for current remediation guidance. Until a patch is available, restrict local access to trusted users and avoid processing untrusted compressed YAML files with rpmio support enabled.