CVE-2026-68742

MediumCVSS 5.5/10Last modified Aug 31, 2026

Description

A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published: Aug 3, 2026
Last modified: Aug 31, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-687437.1A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the r CVE-2026-687443.3A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries b CVE-2026-687458.1Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent t CVE-2026-687468.8Not Failing Securely ('Failing Open') vulnerability in livebook-dev livebook allows an unauthenticated network client to obtain full access CVE-2026-687476.1Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrre CVE-2026-687497.5Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote atta CVE-2026-68759.5ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could e CVE-2026-687507.5Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenticated remote attacke CVE-2026-687527.2A Project Resource Manager may gain broader administrative privileges under specific conditions.CVE-2026-687535.3An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.CVE-2026-687546.5A repository publisher without delete permission may modify protected package content under specific conditions.CVE-2026-687554.3A bundle writer may create misleading release promotion information under specific conditions.