CVE-2026-104031
published 2026-10-06CVE-2026-104031: A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is not…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.10%
0.6th percentile
A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is not released until the client connection terminates. A local attacker can exploit this vulnerability by maintaining an open connection and repeatedly submitting valid requests, leading to memory exhaustion and a Denial of Service (DoS).
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | sssd | — | — |
| fedoraproject | sssd | — | — |
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
SSSD autofs memory allocation
vuldb·2026-10-06·CVSS 5.5
CVE-2026-104031 [MEDIUM] SSSD autofs memory allocation
A vulnerability was found in SSSD and classified as critical. This affects an unknown part of the component autofs. The manipulation results in uncontrolled memory allocation.
This vulnerability is cataloged as CVE-2026-104031. The attack may be launched remotely. There is no exploit available.
GHSA
A flaw was found in SSSD.
ghsa_unreviewed·2026-10-06
CVE-2026-104031 [MEDIUM] CWE-772 A flaw was found in SSSD.
A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is not released until the client connection terminates. A local attacker can exploit this vulnerability by maintaining an open connection and repeatedly submitting valid requests, leading to memory exhaustion and a Denial of Service (DoS).
Red Hat
sssd: SSSD: Denial of Service via memory exhaustion in autofs responder
vendor_redhat·2026-10-05·CVSS 5.5
CVE-2026-104031 [MEDIUM] CWE-772 sssd: SSSD: Denial of Service via memory exhaustion in autofs responder
sssd: SSSD: Denial of Service via memory exhaustion in autofs responder
A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is not released until the client connection terminates. A local attacker can exploit this vulnerability by maintaining an open connection and repeatedly submitting valid requests, leading to memory exhaustion and a Denial of Service (DoS).
Statement: Red Hat rates this vulnerability as Moderate severity because exploitation requires local access to an active SSSD autofs responder socket, and the impact is confined to memory exhaustion without compromising system confidentiality or integrity. On standard Red Hat Enterprise Linux systems, the autofs responder is not enabled by
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-104031 sssd: SSSD: Denial of Service via memory exhaustion in autofs responder [fedora-all]
bugzilla·2026-10-05·CVSS 5.5
CVE-2026-104031 [MEDIUM] CVE-2026-104031 sssd: SSSD: Denial of Service via memory exhaustion in autofs responder [fedora-all]
CVE-2026-104031 sssd: SSSD: Denial of Service via memory exhaustion in autofs responder [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
AI_ONLY_REPORT
package: sssd-2.12.0-1.el10
Summary: Local DoS in Autofs responder due to per-request `autofs_cmd_ctx`
lifetime bug (and pinned enum references): successful autofs responder
requests can retain per-request state until connection close, allowing
local memory exhaustion when the autofs responder/socket is enabled and
reachable.
Requirements to exploit: A local actor must be able to reach the autofs
responder/socket in an affected deployment, keep a client
Bugzilla
CVE-2026-104031 sssd: SSSD: Denial of Service via memory exhaustion in autofs responder
bugzilla·2026-05-18·CVSS 5.5
CVE-2026-104031 [MEDIUM] CVE-2026-104031 sssd: SSSD: Denial of Service via memory exhaustion in autofs responder
CVE-2026-104031 sssd: SSSD: Denial of Service via memory exhaustion in autofs responder
AI_ONLY_REPORT
package: sssd-2.12.0-1.el10
Summary: Local DoS in Autofs responder due to per-request `autofs_cmd_ctx`
lifetime bug (and pinned enum references): successful autofs responder
requests can retain per-request state until connection close, allowing
local memory exhaustion when the autofs responder/socket is enabled and
reachable.
Requirements to exploit: A local actor must be able to reach the autofs
responder/socket in an affected deployment, keep a client connection open,
and send a large number of valid autofs requests that complete successfully.
Component affected: `sssd-2.12.0-1.el10` Autofs responder, primarily
`src/responder/autofs/autofssrv_cmd.c`
(`sss_autofs_cmd_setautomntent_done`
2026-10-06
Published