CVE-2026-90995
published 2026-09-14CVE-2026-90995: A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder…
PriorityP423medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.14%
2.7th percentile
A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder socket can send a specially crafted protocol request. If the `pam_app_services` configuration is enabled and the service item is omitted from the request, a NULL pointer dereference can occur. This vulnerability leads to a denial of service, causing the PAM responder to crash and disrupt authentication services.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | sssd | — | — |
| fedoraproject | sssd | — | — |
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Red Hat Enterprise Linux/OpenShift Container Platform PAM Responder null pointer dereference (Nessus ID 345688)
vuldb·2026-09-15·CVSS 5.5
CVE-2026-90995 [MEDIUM] Red Hat Enterprise Linux/OpenShift Container Platform PAM Responder null pointer dereference (Nessus ID 345688)
A vulnerability was found in Red Hat Enterprise Linux and OpenShift Container Platform. It has been classified as critical. The impacted element is an unknown function of the component PAM Responder. This manipulation causes null pointer dereference.
This vulnerability is tracked as CVE-2026-90995. The attack is restricted to local execution. No exploit exists.
GHSA
A flaw was found in SSSD (System Security Services Daemon).
ghsa_unreviewed·2026-09-14
CVE-2026-90995 [MEDIUM] CWE-476 A flaw was found in SSSD (System Security Services Daemon).
A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder socket can send a specially crafted protocol request. If the `pam_app_services` configuration is enabled and the service item is omitted from the request, a NULL pointer dereference can occur. This vulnerability leads to a denial of service, causing the PAM responder to crash and disrupt authentication services.
Red Hat
sssd: SSSD: Local denial of service due to NULL pointer dereference in PAM responder
vendor_redhat·2026-09-14·CVSS 5.5
CVE-2026-90995 [MEDIUM] CWE-476 sssd: SSSD: Local denial of service due to NULL pointer dereference in PAM responder
sssd: SSSD: Local denial of service due to NULL pointer dereference in PAM responder
A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder socket can send a specially crafted protocol request. If the `pam_app_services` configuration is enabled and the service item is omitted from the request, a NULL pointer dereference can occur. This vulnerability leads to a denial of service, causing the PAM responder to crash and disrupt authentication services.
A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder socket can send a specially crafted protocol request. If the `pam_app_services`
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-90995 sssd: SSSD: Local denial of service due to NULL pointer dereference in PAM responder [fedora-all]
bugzilla·2026-09-23·CVSS 5.5
CVE-2026-90995 [MEDIUM] CVE-2026-90995 sssd: SSSD: Local denial of service due to NULL pointer dereference in PAM responder [fedora-all]
CVE-2026-90995 sssd: SSSD: Local denial of service due to NULL pointer dereference in PAM responder [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
AI_ONLY_REPORT
package: sssd-2.12.0-1.el10
Summary: Local DoS in PAM responder: NULL dereference in
`get_domain_request_type()` when `SSS_PAM_ITEM_SERVICE` is omitted: a
crafted local PAM protocol v2/v3 request that omits the service item can
leave `pd->service` as `NULL` and trigger a NULL dereference in the PAM
responder when `[pam] pam_app_services` is configured, causing denial of
service.
Requirements to exploit: Local access sufficient to connect to t
Bugzilla
CVE-2026-90995 sssd: SSSD: Local denial of service due to NULL pointer dereference in PAM responder
bugzilla·2026-05-18·CVSS 5.5
CVE-2026-90995 [MEDIUM] CVE-2026-90995 sssd: SSSD: Local denial of service due to NULL pointer dereference in PAM responder
CVE-2026-90995 sssd: SSSD: Local denial of service due to NULL pointer dereference in PAM responder
AI_ONLY_REPORT
package: sssd-2.12.0-1.el10
Summary: Local DoS in PAM responder: NULL dereference in
`get_domain_request_type()` when `SSS_PAM_ITEM_SERVICE` is omitted: a
crafted local PAM protocol v2/v3 request that omits the service item can
leave `pd->service` as `NULL` and trigger a NULL dereference in the PAM
responder when `[pam] pam_app_services` is configured, causing denial of
service.
Requirements to exploit: Local access sufficient to connect to the PAM
responder socket and send a crafted PAM protocol v2/v3 request that omits
`SSS_PAM_ITEM_SERVICE`; the target must use a non-empty `[pam]
pam_app_services` configuration.
Component affected: `sssd-2.12.0-1.el10`, PAM responder code
2026-09-14
Published