libmodulemd - Debian Package Tracker

general

source: libmodulemd (main)
version: 2.15.3-1
maintainer: RPM packaging team (DMD)
uploaders: Luca Boccassi [DMD] – Peter Pentchev [DMD]
arch: any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.12.0-1
oldstable: 2.14.0-3
stable: 2.15.0-1
testing: 2.15.3-1
unstable: 2.15.3-1

versioned links

2.12.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.14.0-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.15.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.15.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

gir1.2-modulemd-2.0
libmodulemd-dev
libmodulemd-tools
libmodulemd2

action needed

3 security issues in sid high

There are 3 open security issues in sid.

3 important issues:

CVE-2026-92822: A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service.
CVE-2026-92823: A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.
CVE-2026-92824: A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.

Created: 2026-10-21 Last update: 2026-10-27 00:30

3 security issues in forky high

There are 3 open security issues in forky.

3 important issues:

CVE-2026-92822: A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service.
CVE-2026-92823: A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.
CVE-2026-92824: A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.

Created: 2026-10-21 Last update: 2026-10-27 00:30

3 security issues in bookworm high

There are 3 open security issues in bookworm.

3 important issues:

CVE-2026-92822: A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service.
CVE-2026-92823: A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.
CVE-2026-92824: A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.

Created: 2026-10-21 Last update: 2026-10-27 00:30

1 new commit since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit f5dab672d8bea6b616dea9a4afb18eea9666a12c
Author: Peter Pentchev <roam@ringlet.net>
Date:   Tue Aug 4 18:15:17 2026 +0300

    Remove myself as an uploader

Created: 2026-08-04 Last update: 2026-10-22 16:32

lintian reports 2 warnings normal

Lintian reports 2 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-02-28 Last update: 2026-06-17 06:30

3 low-priority security issues in trixie low

There are 3 open security issues in trixie.

3 issues left for the package maintainer to handle:

CVE-2026-92822: (needs triaging) A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service.
CVE-2026-92823: (needs triaging) A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.
CVE-2026-92824: (needs triaging) A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-10-21 Last update: 2026-10-27 00:30

news

[rss feed]

[2026-06-22] libmodulemd 2.15.3-1 MIGRATED to testing (Debian testing watch)
[2026-06-16] Accepted libmodulemd 2.15.3-1 (source) into unstable (Luca Boccassi)
[2026-04-03] libmodulemd 2.15.2-4 MIGRATED to testing (Debian testing watch)
[2026-04-01] Accepted libmodulemd 2.15.2-4 (source) into unstable (Luca Boccassi)
[2026-02-07] libmodulemd 2.15.2-3 MIGRATED to testing (Debian testing watch)
[2026-02-04] Accepted libmodulemd 2.15.2-3 (source) into unstable (Peter Pentchev)
[2026-02-04] Accepted libmodulemd 2.15.2-2 (source) into unstable (Peter Pentchev)
[2026-01-08] libmodulemd 2.15.2-1 MIGRATED to testing (Debian testing watch)
[2026-01-06] Accepted libmodulemd 2.15.2-1 (source) into unstable (Peter Pentchev)
[2024-12-20] libmodulemd 2.15.0-1 MIGRATED to testing (Debian testing watch)
[2024-12-18] Accepted libmodulemd 2.15.0-1 (source) into unstable (Peter Pentchev)
[2023-05-04] libmodulemd 2.14.0-3 MIGRATED to testing (Debian testing watch)
[2023-04-29] Accepted libmodulemd 2.14.0-3 (source) into unstable (Peter Pentchev)
[2023-01-11] libmodulemd 2.14.0-2 MIGRATED to testing (Debian testing watch)
[2023-01-05] Accepted libmodulemd 2.14.0-2 (source) into unstable (Peter Pentchev)
[2022-09-14] libmodulemd 2.14.0-1 MIGRATED to testing (Debian testing watch)
[2022-09-11] Accepted libmodulemd 2.14.0-1 (source) into unstable (Peter Pentchev)
[2021-10-31] libmodulemd 2.13.0-1 MIGRATED to testing (Debian testing watch)
[2021-10-31] libmodulemd 2.13.0-1 MIGRATED to testing (Debian testing watch)
[2021-10-31] libmodulemd 2.13.0-1 MIGRATED to testing (Debian testing watch)
[2021-10-28] Accepted libmodulemd 2.13.0-1 (source) into unstable (Peter Pentchev)
[2021-02-22] libmodulemd 2.12.0-1 MIGRATED to testing (Debian testing watch)
[2021-02-11] Accepted libmodulemd 2.12.0-1 (source) into unstable (Peter Pentchev)
[2020-07-28] libmodulemd 2.9.4-2 MIGRATED to testing (Debian testing watch)
[2020-07-26] Accepted libmodulemd 2.9.4-2 (source) into unstable (Peter Pentchev)
[2020-07-22] Accepted libmodulemd 2.9.4-1 (amd64 source) into unstable, unstable (Debian FTP Masters) (signed by: Peter Pentchev)

bugs [bug history graph]

all: 0

links

homepage
lintian (0, 2)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.15.3-1