Sssd: sssd: denial of service via stale connection state reuse in pam gssapi responder
Historical advisory recorded 3 Nov 2026 22:57:17 UTC. Read the latest advisory.
cve-program · CVE-2026-104039
PublishedA flaw was found in SSSD. A local user can cause a denial of service (DoS) by disrupting system authentication services. When handling Generic Security Services Application Programming Interface (GSSAPI) authentication in the Pluggable Authentication Module (PAM) responder, cached connection state is freed upon completion without clearing the reference pointer. An attacker can exploit this by sending an additional request over the same connection, causing the service to access invalid memory and unexpectedly terminate.
Read the publisher's advisoryAffected versions, risk and source history
cve-program · CVE-2026-104039
PublishedSssd: sssd: denial of service via stale connection state reuse in pam gssapi responder
A flaw was found in SSSD. A local user can cause a denial of service (DoS) by disrupting system authentication services. When handling Generic Security Services Application Programming Interface (GSSAPI) authentication in the Pluggable Authentication Module (PAM) responder, cached connection state is freed upon completion without clearing the reference pointer. An attacker can exploit this by sending an additional request over the same connection, causing the service to access invalid memory and unexpectedly terminate.
- Source published
- 6 Oct 2026 01:00:41 UTC
- Source modified
- 3 Nov 2026 20:29:59 UTC
- Saved here
- 3 Nov 2026 22:57:17 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H