CVE-2026-90996

Published: Sep 14, 2026Modified: Oct 7, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affects the availability of the system responder.

Affected (6)

Products: Fedoraproject: Sssd · Redhat: Enterprise Linux, Openshift Container Platform

1 product

2 products

Openshift Container Platform

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Sssd	Version 2.12.0
Redhat Enterprise Linux	Version 10.0
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux	Version 9.0
Redhat Openshift Container Platform	Version 4.0

Related CWEs

CWE-191

Integer Underflow (Wrap or Wraparound)

The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

References (2)

https://access.redhat.com/security/cve/CVE-2026-90996

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2478986

Source: secalert@redhat.com

ExploitIssue TrackingMitigationVendor Advisory

Timeline

No history available yet.