CVE-2026-68743
published 2026-08-04CVE-2026-68743: A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer…
PriorityP431high7.1CVSS 3.1
AVLACLPRLUINSUCHINAH
EPSS
0.13%
2.6th percentile
A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
| ubuntu | sssd | — | — |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in SSSD.
ghsa_unreviewed·2026-08-04
CVE-2026-68743 [MEDIUM] CWE-125 A flaw was found in SSSD.
A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.
Ubuntu
SSSD vulnerability
vendor_ubuntu·2026-09-03
CVE-2026-68743 SSSD vulnerability
Title: SSSD vulnerability
Summary: SSSD could be made to crash if it received specially crafted input.
It was discovered that SSSD did not properly validate authentication token
lengths when processing PAM responder requests. A local attacker could
possibly use this issue to cause SSSD to crash, resulting in a denial of
service.
Instructions: After a standard system update you need to restart sssd to make all the
necessary changes.
Red Hat
sssd: sssd: PAM responder out-of-bounds read via unchecked auth_token_length in protocol v1
vendor_redhat·2026-08-03·CVSS 5.5
CVE-2026-68743 [MEDIUM] CWE-125 sssd: sssd: PAM responder out-of-bounds read via unchecked auth_token_length in protocol v1
sssd: sssd: PAM responder out-of-bounds read via unchecked auth_token_length in protocol v1
A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.
Statement: This issue can only be triggered by a local attacker who can connect to the SSSD PAM responder unix socket and send crafted protocol v1 requests. The stock PAM client uses protocol v3 and is not affected by this path. On SSSD 2.10 and later, responders run as an unprivileged user; on earlier versions they may run as root. In either c
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-68743 sssd: sssd: PAM responder out-of-bounds read via unchecked auth_token_length in protocol v1 [fedora-all]
bugzilla·2026-08-03
CVE-2026-68743 [MEDIUM] CVE-2026-68743 sssd: sssd: PAM responder out-of-bounds read via unchecked auth_token_length in protocol v1 [fedora-all]
CVE-2026-68743 sssd: sssd: PAM responder out-of-bounds read via unchecked auth_token_length in protocol v1 [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder (src/responder/pam/pamsrv_cmd.c) reads a 32-bit auth_token_length from the client request but does not validate it against the remaining buffer size before passing it to sss_authtok_set_password(). When sss_authtok_set_string() processes the token, it accesses str[len-1] using the unvalidated length, resulting in a heap-buffer-overflow read. A local attacker can trigger
Bugzilla
CVE-2026-68743 sssd: sssd: PAM responder out-of-bounds read via unchecked auth_token_length in protocol v1
bugzilla·2026-07-31
CVE-2026-68743 [MEDIUM] CVE-2026-68743 sssd: sssd: PAM responder out-of-bounds read via unchecked auth_token_length in protocol v1
CVE-2026-68743 sssd: sssd: PAM responder out-of-bounds read via unchecked auth_token_length in protocol v1
A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder (src/responder/pam/pamsrv_cmd.c) reads a 32-bit auth_token_length from the client request but does not validate it against the remaining buffer size before passing it to sss_authtok_set_password(). When sss_authtok_set_string() processes the token, it accesses str[len-1] using the unvalidated length, resulting in a heap-buffer-overflow read. A local attacker can trigger this by connecting to the world-writable PAM responder socket (/var/lib/sss/pipes/pam) and sending a crafted protocol v1 authentication request with an oversized auth_token_length value. The stock PAM client uses protocol v3, so this is o
2026-08-04
Published