Medium severity · published Oct 6, 2026
CVE-2026-104045
Sssd: sssd: denial of service via race condition in autofs responder
4.7
CVSS
0.1%
EPSS
No
On KEV
Description
A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between asynchronous enumeration completion and map invalidation. By repeatedly sending concurrent map enumeration and invalidation requests, an attacker can cause memory to leak, leading to excessive memory consumption that can disrupt or crash the autofs service.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 6 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 9 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat OpenShift Container Platform 4 · Red Hat
All versions, or not specified · source: vendor
EL
Enterprise Linux · Redhat
7.0; 8.0; 9.0; 10.0 · source: NVD
OC
Openshift Container Platform · Redhat
4.0 · source: NVD
SS
Sssd · Fedoraproject
2.12.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-104045
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-104045
vdb-entry
https://access.redhat.com/security/cve/CVE-2026-104045
issue-tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2478663
More from Red Hat Enterprise Linux 10
7.8
CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place
7.5
CVE-2026-34486
Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
10.0
CVE-2026-46595
Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
9.8
CVE-2026-102560
Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth
9.8
CVE-2026-18922
389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property