What’s Vulnerable › Vulnerabilities

CVE-2026-104041: Sssd: sssd: denial of service via unbounded negative cache growth

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-06 · updated 2026-10-31
• Weakness: CWE-770

Description

A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for nonexistent entries through the Name Service Switch (NSS) responder. Because the negative cache does not limit the total number of stored entries and only removes expired records when an existing key is rechecked, the cache can grow without bound. This behavior can lead to memory exhaustion, resulting in a Denial of Service (DoS) as the responder becomes unresponsive or terminates.

Affected products

• Red Hat OpenShift Container Platform 4.18: all versions
• Red Hat Enterprise Linux 10: all versions
• Red Hat Enterprise Linux 7: all versions
• Red Hat Enterprise Linux 8: all versions
• Red Hat Enterprise Linux 9: all versions
• Red Hat OpenShift Container Platform 5: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-104041
• https://bugzilla.redhat.com/show_bug.cgi?id=2478864
• https://bugzilla.redhat.com/show_bug.cgi?id=2478864

Get alerted when CVE-2026-104041 or the next vulnerability affects your stack