← Back

CVE-2026-104046

nvd nist
Published: Oct 6, 2026Modified: Oct 13, 2026

JSON object

Loading...
6.2
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 2.5 / Impact: 3.6
Source: secalert@redhat.com (Secondary)

Description

A flaw was found in SSSD (System Security Services Daemon). When Identity Provider (IdP) authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing unbounded memory consumption. This memory exhaustion can lead to a Denial of Service (DoS) by degrading or terminating SSSD authentication services.

Affected (6)

Fedoraproject
1 product
Sssd
Redhat
2 products
Enterprise Linux
Openshift Container Platform
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Sssd
Version 2.12.0
Redhat
Enterprise Linux
Version 10.0
Enterprise Linux
Version 7.0
Enterprise Linux
Version 8.0
Enterprise Linux
Version 9.0
Openshift Container Platform
Version 4.0

Related CWEs

CWE-770
Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (2)

Source: secalert@redhat.com
Vendor Advisory
Source: secalert@redhat.com
ExploitIssue TrackingMitigationVendor Advisory

Timeline

No history available yet.