Multiple denial of service vulnerabilities were found in libmodulemd prior to version 2.13.0-4.oe2203sp4. These include stack exhaustion due to unbounded recursion when parsing deeply nested xmd YAML content (CVE-2026-92822), excessive CPU and memory consumption from decompressing highly compressible compressed YAML without size limits (CVE-2026-92823), and an out-of-bounds read causing crashes during YAML serialization of module stream v2 metadata with multiple digest types (CVE-2026-92824).