CVE-2026-88252
published 2026-10-06CVE-2026-88252: A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles…
PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.13%
2.4th percentile
A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles used for open connections). By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection attempts, an attacker can trigger an unthrottled retry loop. This condition leads to high CPU utilization and stalls the service, preventing legitimate identity and authentication requests from being processed.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | sssd | — | — |
| fedoraproject | sssd | — | — |
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
sssd: sssd: Denial of Service via responder connection retry loop during file descriptor exhaustion
vendor_redhat·2026-10-06·CVSS 4.7
CVE-2026-88252 [MEDIUM] CWE-835 sssd: sssd: Denial of Service via responder connection retry loop during file descriptor exhaustion
sssd: sssd: Denial of Service via responder connection retry loop during file descriptor exhaustion
A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles used for open connections). By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection attempts, an attacker can trigger an unthrottled retry loop. This condition leads to high CPU utilization and stalls the service, preventing legitimate identity and authentication requests from being processed.
Statement: Red Hat has classified this vulnerability as Moderate severity because exploitation requires local access and solely impacts service availability rather than compromising sys
GHSA
A flaw was found in sssd.
ghsa_unreviewed·2026-10-06
CVE-2026-88252 [MEDIUM] CWE-835 A flaw was found in sssd.
A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles used for open connections). By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection attempts, an attacker can trigger an unthrottled retry loop. This condition leads to high CPU utilization and stalls the service, preventing legitimate identity and authentication requests from being processed.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-88252 sssd: sssd: Denial of Service via responder connection retry loop during file descriptor exhaustion [fedora-all]
bugzilla·2026-10-06·CVSS 4.7
CVE-2026-88252 [MEDIUM] CVE-2026-88252 sssd: sssd: Denial of Service via responder connection retry loop during file descriptor exhaustion [fedora-all]
CVE-2026-88252 sssd: sssd: Denial of Service via responder connection retry loop during file descriptor exhaustion [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
AI_ONLY_REPORT
package: sssd-2.12.0-1.el10
Summary: Local DoS in responder `accept()` path via EMFILE/ENFILE retry
spin: a local user who can reach an affected responder UNIX socket can
force `accept()` failures under file descriptor exhaustion and trigger a
busy retry loop that stalls responder service.
Requirements to exploit: Local access to a responder UNIX socket serviced
by `accept_fd_handler()`, plus the ability to create and hold enou
Bugzilla
CVE-2026-88252 sssd: sssd: Denial of Service via responder connection retry loop during file descriptor exhaustion
bugzilla·2026-05-18·CVSS 4.7
CVE-2026-88252 [MEDIUM] CVE-2026-88252 sssd: sssd: Denial of Service via responder connection retry loop during file descriptor exhaustion
CVE-2026-88252 sssd: sssd: Denial of Service via responder connection retry loop during file descriptor exhaustion
AI_ONLY_REPORT
package: sssd-2.12.0-1.el10
Summary: Local DoS in responder `accept()` path via EMFILE/ENFILE retry
spin: a local user who can reach an affected responder UNIX socket can
force `accept()` failures under file descriptor exhaustion and trigger a
busy retry loop that stalls responder service.
Requirements to exploit: Local access to a responder UNIX socket serviced
by `accept_fd_handler()`, plus the ability to create and hold enough
concurrent connections to push the responder into `EMFILE` or `ENFILE`
while keeping the listen queue non-empty. Practical reachability depends on
an affected responder being enabled and locally reachable.
Component affected: `sssd-2.1
2026-10-06
Published