A flaw was discovered in libmodulemd where, in builds that enable rpmio support, compressed module metadata is decompressed through a custom read handler that does not enforce a limit on the total amount of data decompressed before parsing. An attacker who can supply a highly compressible compressed YAML file can cause the system to consume excessive CPU and memory, leading to a denial of service. The weakness relates to an unchecked resource consumption condition, corresponding to CWE‑409.

Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 are the vendor products listed as affected. Specific version numbers are not provided in the available data, so all current releases of these products are potentially impacted.

The CVSS score for this vulnerability is 6.2, indicating moderate severity, while the EPSS score is below 1 %, implying a very low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires an attacker to supply a compressed module file, which may be feasible in environments that allow user‑supplied packaging or remote module deployment. The exploit requires only the ability to influence the module metadata being processed by libmodulemd; once triggered, it can exhaust system resources quickly and disrupt service availability.