{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-104041", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-10-01T17:24:07.171Z", "datePublished": "2026-10-06T01:00:49.767Z", "dateUpdated": "2026-10-16T10:57:48.588Z" }, "containers": { "cna": { "title": "Sssd: sssd: denial of service via unbounded negative cache growth", "metrics": [ { "other": { "content": { "value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "format": "CVSS" } ], "descriptions": [ { "lang": "en", "value": "A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for nonexistent entries through the Name Service Switch (NSS) responder. Because the negative cache does not limit the total number of stored entries and only removes expired records when an existing key is rechecked, the cache can grow without bound. This behavior can lead to memory exhaustion, resulting in a Denial of Service (DoS) as the responder becomes unresponsive or terminates." } ], "affected": [ { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "sssd", "defaultStatus": "affected", "cpes": [ "cpe:/o:redhat:enterprise_linux:10" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "sssd", "defaultStatus": "unknown", "cpes": [ "cpe:/o:redhat:enterprise_linux:6" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "sssd", "defaultStatus": "affected", "cpes": [ "cpe:/o:redhat:enterprise_linux:7" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "sssd", "defaultStatus": "affected", "cpes": [ "cpe:/o:redhat:enterprise_linux:8" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "sssd", "defaultStatus": "affected", "cpes": [ "cpe:/o:redhat:enterprise_linux:9" ] }, { "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift/ose-rhel-coreos-8", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:openshift:4" ] }, { "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift/ose-rhel-coreos-9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:openshift:4" ] } ], "references": [ { "url": "https://access.redhat.com/security/cve/CVE-2026-104041", "tags": [ "vdb-entry", "x_refsource_REDHAT" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2478864", "name": "RHBZ#2478864", "tags": [ "issue-tracking", "x_refsource_REDHAT" ] } ], "datePublic": "2026-10-06T00:42:11.968Z", "problemTypes": [ { "descriptions": [ { "cweId": "CWE-770", "description": "Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE" } ] } ], "x_redhatCweChain": "CWE-770: Allocation of Resources Without Limits or Throttling", "workarounds": [ { "lang": "en", "value": "Set `entry_negative_timeout = 0` in the `[nss]` section of `/etc/sssd/sssd.conf` to disable non-permanent negative-cache insertions, then restart the SSSD service (for example, `systemctl restart sssd`) to apply the change. Note that restarting sssd briefly interrupts active authentication and identity lookups, and disabling the negative cache increases lookup traffic to identity backends for nonexistent entries. If responder memory growth is observed, the accumulated negative-cache state can be cleared through the existing operational clear path or by restarting the responder. Restricting untrusted local users also limits exposure on systems where the NSS responder socket is reachable by local users." } ], "timeline": [ { "lang": "en", "time": "2026-05-18T03:32:25.000Z", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2026-10-06T00:42:11.968Z", "value": "Made public." } ], "credits": [ { "lang": "en", "value": "This issue was discovered by Found by AISLE in partnership with Red Hat." } ], "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-16T10:57:48.588Z" }, "x_generator": { "engine": "cvelib 1.8.0" } }, "adp": [ { "references": [ { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2478864", "tags": [ "exploit" ] } ], "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-10-06T13:19:20.997446Z", "id": "CVE-2026-104041", "options": [ { "Exploitation": "poc" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T13:21:25.730Z" } } ] } }