CVE-2026-68742
published 2026-08-03CVE-2026-68742: A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body…
PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.13%
2.4th percentile
A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | sssd | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Red Hat Enterprise Linux/OpenShift Container Platform NSS Responder sss_nss_protocol_parse_addr addrlen out-of-bounds (Nessus ID 331690)
vuldb·2026-08-04·CVSS 5.5
CVE-2026-68742 [MEDIUM] Red Hat Enterprise Linux/OpenShift Container Platform NSS Responder sss_nss_protocol_parse_addr addrlen out-of-bounds (Nessus ID 331690)
A vulnerability classified as problematic was found in Red Hat Enterprise Linux and OpenShift Container Platform. Affected is the function sss_nss_protocol_parse_addr of the component NSS Responder. The manipulation of the argument addrlen results in out-of-bounds read.
This vulnerability is known as CVE-2026-68742. Attacking locally is a requirement. No exploit is available.
GHSA
A flaw was found in SSSD.
ghsa_unreviewed·2026-08-03
CVE-2026-68742 [MEDIUM] CWE-125 A flaw was found in SSSD.
A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.
Red Hat
sssd: sssd: NSS responder out-of-bounds read via unchecked addrlen in GETHOSTBYADDR
vendor_redhat·2026-08-03·CVSS 5.5
CVE-2026-68742 [MEDIUM] CWE-125 sssd: sssd: NSS responder out-of-bounds read via unchecked addrlen in GETHOSTBYADDR
sssd: sssd: NSS responder out-of-bounds read via unchecked addrlen in GETHOSTBYADDR
A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.
Statement: This issue can only be triggered by a local attacker who can connect to the SSSD NSS responder unix socket and send crafted requests. The over-read bytes are used as a lookup key and are not returned to the client, so the impact is limited to denial of service. The sssd monitor may respawn the responder, but repeated crashes can lead to a persistent nam
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-68742 sssd: sssd: NSS responder out-of-bounds read via unchecked addrlen in GETHOSTBYADDR [fedora-all]
bugzilla·2026-08-03·CVSS 5.5
CVE-2026-68742 [MEDIUM] CVE-2026-68742 sssd: sssd: NSS responder out-of-bounds read via unchecked addrlen in GETHOSTBYADDR [fedora-all]
CVE-2026-68742 sssd: sssd: NSS responder out-of-bounds read via unchecked addrlen in GETHOSTBYADDR [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder (src/responder/nss/nss_protocol.c) extracts a 32-bit addrlen value from the client request but only validates that the body is at least 8 bytes, without checking that addrlen fits within the remaining packet body. This unvalidated length is passed through to talloc_memdup() in cache_req_data_create(), which copies addrlen bytes from the small request buffer, causing a h
Bugzilla
CVE-2026-68742 sssd: sssd: NSS responder out-of-bounds read via unchecked addrlen in GETHOSTBYADDR
bugzilla·2026-07-31·CVSS 5.5
CVE-2026-68742 [MEDIUM] CVE-2026-68742 sssd: sssd: NSS responder out-of-bounds read via unchecked addrlen in GETHOSTBYADDR
CVE-2026-68742 sssd: sssd: NSS responder out-of-bounds read via unchecked addrlen in GETHOSTBYADDR
A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder (src/responder/nss/nss_protocol.c) extracts a 32-bit addrlen value from the client request but only validates that the body is at least 8 bytes, without checking that addrlen fits within the remaining packet body. This unvalidated length is passed through to talloc_memdup() in cache_req_data_create(), which copies addrlen bytes from the small request buffer, causing a heap-buffer-overflow read. A local attacker can trigger this by connecting to the world-writable NSS responder socket (/var/lib/sss/pipes/nss) and sending a SSS_NSS_GETHOSTBYADDR (0x0053) request with a large addrlen value and a valid addr
2026-08-03
Published