CVE-2026-104045

Published: Oct 6, 2026Modified: Oct 13, 2026

4.7

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.0 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between asynchronous enumeration completion and map invalidation. By repeatedly sending concurrent map enumeration and invalidation requests, an attacker can cause memory to leak, leading to excessive memory consumption that can disrupt or crash the autofs service.

Affected (6)

Products: Fedoraproject: Sssd · Redhat: Enterprise Linux, Openshift Container Platform

1 product

2 products

Openshift Container Platform

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Sssd	Version 2.12.0
Redhat Enterprise Linux	Version 10.0
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux	Version 9.0
Redhat Openshift Container Platform	Version 4.0

Related CWEs

CWE-772

Missing Release of Resource after Effective Lifetime

The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

References (3)

https://access.redhat.com/security/cve/CVE-2026-104045

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2478663

Source: secalert@redhat.com

ExploitIssue TrackingMitigationVendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2478663

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitIssue TrackingMitigationVendor Advisory

Timeline

No history available yet.