A flaw in libmodulemd allows attackers to provide arbitrarily deep YAML in the xmd field of a modulemd document. During processing, the parser converts this YAML into nested GVariant structures without limiting recursion depth or node count. This can exhaust the process stack or consume excessive memory, causing the target application to become unresponsive or crash. The weakness corresponds to the common vulnerability category CWE‑674, unbounded recursion or loop.

Red Hat Enterprise Linux 8, 9, 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 leverage libmodulemd. Systems running any kernel or image that includes this library are therefore affected.

The CVSS score of 6.2 indicates moderate severity, while the EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in CISA’s KEV catalog, meaning no publicly known, actively used exploit is reported. Likely attack vectors involve supplying a crafted modulemd file—either locally by an attacker with write access to the system or remotely if the application imports module metadata from untrusted sources. If executed, the resulting denial of service would impact availability for the affected host or cluster.