CVE-2026-104031

MediumCVSS 5.5/10Last modified Oct 6, 2026

Description

A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is not released until the client connection terminates. A local attacker can exploit this vulnerability by maintaining an open connection and repeatedly submitting valid requests, leading to memory exhaustion and a Denial of Service (DoS).

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-772

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 6, 2026
Last modified
Oct 6, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-1040325.5A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates through the autofs responder due toCVE-2026-1040335.4A flaw was found in SSSD. When configured to enforce account expiration using LDAP (Lightweight Directory Access Protocol) shadow attributesCVE-2026-1040344.7A flaw was found in SSSD. A use-after-free vulnerability exists in the Kerberos Credential Manager (KCM) responder during Kerberos ticket-grCVE-2026-1040355.5A flaw was found in SSSD. An issue in the Kerberos Credential Manager (KCM) responder allows a local user to cause a Denial of Service (DoS)CVE-2026-1040365.8A flaw was found in SSSD's NFS idmap plugin. When retrieving cached user or group names, the plugin detects if an entry exceeds the destinatCVE-2026-1040375.5A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to thCVE-2026-1040385.9A flaw was found in sssd. A remote attacker can cause a denial of service (DoS) by submitting a certificate that lacks an expected Security CVE-2026-1040394.7A flaw was found in SSSD. A local user can cause a denial of service (DoS) by disrupting system authentication services. When handling GenerCVE-2026-1040406.1A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly CVE-2026-1040415.5A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for nonexistent entries through the Name Service Switch CVE-2026-1040425.5A flaw was found in sssd. A local attacker can cause a Denial of Service (DoS) by sending a crafted Pluggable Authentication Module (PAM) reCVE-2026-1040435.5A flaw was found in SSSD. A local attacker with access to the Name Service Switch (NSS) responder UNIX socket can trigger an integer underfl